From c92a95237682c4a4ab4bca1596a653c6b7f7037e Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Thu, 12 Nov 2026 09:47:58 +0100 Subject: [PATCH] NVD update 2026-11-12T08:47:52Z --- data/2025/CVE-2025-2399.json | 2 +- data/2025/CVE-2025-47541.json | 2 +- data/2026/CVE-2026-113408.json | 1 + data/2026/CVE-2026-118855.json | 1 + data/2026/CVE-2026-123133.json | 1 + data/2026/CVE-2026-12507.json | 1 + data/2026/CVE-2026-125836.json | 1 + data/2026/CVE-2026-12591.json | 1 + data/2026/CVE-2026-126991.json | 1 + data/2026/CVE-2026-40820.json | 1 + data/2026/CVE-2026-47832.json | 1 + data/2026/CVE-2026-82292.json | 1 + data/2026/CVE-2026-8331.json | 1 + data/2026/CVE-2026-8332.json | 1 + data/2026/CVE-2026-8333.json | 1 + data/2026/CVE-2026-87772.json | 1 + data/2026/CVE-2026-96834.json | 2 +- state/sync.json | 2 +- 18 files changed, 18 insertions(+), 4 deletions(-) create mode 100644 data/2026/CVE-2026-113408.json create mode 100644 data/2026/CVE-2026-118855.json create mode 100644 data/2026/CVE-2026-123133.json create mode 100644 data/2026/CVE-2026-12507.json create mode 100644 data/2026/CVE-2026-125836.json create mode 100644 data/2026/CVE-2026-12591.json create mode 100644 data/2026/CVE-2026-126991.json create mode 100644 data/2026/CVE-2026-40820.json create mode 100644 data/2026/CVE-2026-47832.json create mode 100644 data/2026/CVE-2026-82292.json create mode 100644 data/2026/CVE-2026-8331.json create mode 100644 data/2026/CVE-2026-8332.json create mode 100644 data/2026/CVE-2026-8333.json create mode 100644 data/2026/CVE-2026-87772.json diff --git a/data/2025/CVE-2025-2399.json b/data/2025/CVE-2025-2399.json index ef78a786d7..d0152a79f6 100644 --- a/data/2025/CVE-2025-2399.json +++ b/data/2025/CVE-2025-2399.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800V Series M800VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2051W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800V Series M800VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2052W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80V Series M80V","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2053W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80V Series M80VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2054W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800 Series M800W","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2005W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800 Series M800S","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2006W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80 Series M80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2007W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80 Series M80W","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2008W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC E80 Series E80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2009W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC C80 Series C80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2036W000 all versions"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M750VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W002 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M720VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M730VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M720VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M730VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M750VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W002 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M70V Series M70V","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1018W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC E70 Series E70","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1022W000 versions LJ and prior"}]}],"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683."},{"lang":"es","value":"Vulnerabilidad de validación incorrecta de índice, posición o desplazamiento especificados en la entrada en Mitsubishi Electric CNC Serie M800V M800VW y M800VS, Serie M80V M80V y M80VW, Serie M800 M800W y M800S, Serie M80 M80 y M80W, Serie E80 E80, Serie C80 C80, Serie M700V M750VW, M720VW, 730VW, M720VS, M730VS, y M750VS, Serie M70V M70V, Serie E70 E70, y Herramientas de software NC Trainer2 y NC Trainer2 plus permite a un atacante remoto causar una lectura fuera de límites, lo que resulta en una condición de denegación de servicio al enviar paquetes especialmente diseñados al puerto TCP 683."}],"id":"CVE-2025-2399","lastModified":"2026-08-27T10:16:34.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-10T17:31:56.365207Z","version":"2.0.3"}}]},"published":"2026-03-10T16:44:08.217","references":[{"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","url":"https://jvn.jp/vu/JVNVU95523788/"},{"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-022_en.pdf"}],"sourceIdentifier":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1285"}],"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800V Series M800VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2051W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800V Series M800VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2052W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80V Series M80V","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2053W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80V Series M80VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2054W000 versions BB and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800 Series M800W","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2005W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M800 Series M800S","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2006W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80 Series M80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2007W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M80 Series M80W","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2008W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC E80 Series E80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2009W000 versions FM and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC C80 Series C80","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-2036W000 versions BK and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M750VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W002 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M720VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M730VW","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1015W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M720VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M730VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M700V Series M750VS","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1012W002 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC M70V Series M70V","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1018W000 versions LJ and prior"}]},{"defaultStatus":"unaffected","product":"Mitsubishi Electric CNC E70 Series E70","vendor":"Mitsubishi Electric Corporation","versions":[{"status":"affected","version":"System Number BND-1022W000 versions LJ and prior"}]}],"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70 allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683."},{"lang":"es","value":"Vulnerabilidad de validación incorrecta de índice, posición o desplazamiento especificados en la entrada en Mitsubishi Electric CNC Serie M800V M800VW y M800VS, Serie M80V M80V y M80VW, Serie M800 M800W y M800S, Serie M80 M80 y M80W, Serie E80 E80, Serie C80 C80, Serie M700V M750VW, M720VW, 730VW, M720VS, M730VS, y M750VS, Serie M70V M70V, Serie E70 E70, y Herramientas de software NC Trainer2 y NC Trainer2 plus permite a un atacante remoto causar una lectura fuera de límites, lo que resulta en una condición de denegación de servicio al enviar paquetes especialmente diseñados al puerto TCP 683."}],"id":"CVE-2025-2399","lastModified":"2026-11-12T07:16:41.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-10T17:31:56.365207Z","version":"2.0.3"}}]},"published":"2026-03-10T16:44:08.217","references":[{"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","url":"https://jvn.jp/vu/JVNVU95523788/"},{"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2025-022_en.pdf"}],"sourceIdentifier":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1285"}],"source":"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-47541.json b/data/2025/CVE-2025-47541.json index 88399fd158..73e73ddc34 100644 --- a/data/2025/CVE-2025-47541.json +++ b/data/2025/CVE-2025-47541.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mail-mint","product":"Mail Mint","vendor":"WPFunnels","versions":[{"changes":[{"at":"1.17.8","status":"unaffected"}],"lessThanOrEqual":"1.17.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7."},{"lang":"es","value":"La vulnerabilidad de inserción de información confidencial en los datos enviados en WPFunnels Mail Mint permite recuperar datos confidenciales incrustados. Este problema afecta a Mail Mint desde la versión n/d hasta la 1.17.7."}],"id":"CVE-2025-47541","lastModified":"2026-06-17T09:28:16.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-47541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-23T15:20:02.972380Z","version":"2.0.3"}}]},"published":"2025-05-23T13:15:39.680","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/Wordpress/Plugin/mail-mint/vulnerability/wordpress-mail-mint-1-17-7-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mail-mint","product":"Mail Mint","vendor":"WPFunnels Team","versions":[{"changes":[{"at":"1.17.8","status":"unaffected"}],"lessThanOrEqual":"1.17.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through 1.17.7."},{"lang":"es","value":"La vulnerabilidad de inserción de información confidencial en los datos enviados en WPFunnels Mail Mint permite recuperar datos confidenciales incrustados. Este problema afecta a Mail Mint desde la versión n/d hasta la 1.17.7."}],"id":"CVE-2025-47541","lastModified":"2026-11-12T07:16:44.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-47541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-23T15:20:02.972380Z","version":"2.0.3"}}]},"published":"2025-05-23T13:15:39.680","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mail-mint/vulnerability/wordpress-mail-mint-1-17-7-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113408.json b/data/2026/CVE-2026-113408.json new file mode 100644 index 0000000000..39c7e22939 --- /dev/null +++ b/data/2026/CVE-2026-113408.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"Git","repo":"https://gitlab.com/git-scm/git","vendor":"Git","versions":[{"status":"affected","version":"2.50.1"},{"status":"affected","version":"2.51.2"},{"status":"affected","version":"2.52.0"},{"status":"affected","version":"2.53.0"},{"status":"affected","version":"2.54.0"},{"status":"affected","version":"2.55.0"},{"status":"affected","version":"2.56.0"}]}],"source":"cve@gitlab.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}],"id":"CVE-2026-113408","lastModified":"2026-11-12T07:16:45.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}]},"published":"2026-11-12T07:16:45.597","references":[{"source":"cve@gitlab.com","url":"https://gitlab.com/gitlab-org/git/-/work_items/809"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"cve@gitlab.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-118855.json b/data/2026/CVE-2026-118855.json new file mode 100644 index 0000000000..584bce19ee --- /dev/null +++ b/data/2026/CVE-2026-118855.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","repo":"https://github.com/akaunting/akaunting","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"source":"help@fluidattacks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin."}],"id":"CVE-2026-118855","lastModified":"2026-11-12T08:16:39.930","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}]},"published":"2026-11-12T08:16:39.930","references":[{"source":"help@fluidattacks.com","url":"https://fluidattacks.com/advisories/sabbath"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php"},{"source":"help@fluidattacks.com","url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-123133.json b/data/2026/CVE-2026-123133.json new file mode 100644 index 0000000000..6360e2c6ef --- /dev/null +++ b/data/2026/CVE-2026-123133.json @@ -0,0 +1 @@ +{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID is a duplicate of CVE-2026-116518 and was never published. Both IDs were assigned to the same vulnerability in the ElasticPress WordPress plugin. All CVE users should reference CVE-2026-116518 instead of this ID."}],"id":"CVE-2026-123133","lastModified":"2026-11-12T08:16:41.187","metrics":{},"published":"2026-11-12T08:16:41.187","references":[],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Rejected"} diff --git a/data/2026/CVE-2026-12507.json b/data/2026/CVE-2026-12507.json new file mode 100644 index 0000000000..d4e2b4f0e6 --- /dev/null +++ b/data/2026/CVE-2026-12507.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AssetExplorer","vendor":"Zohocorp","versions":[{"lessThan":"7860","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"Zohocorp","versions":[{"lessThan":"15290","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"Zohocorp","versions":[{"lessThan":"15150","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server."}],"id":"CVE-2026-12507","lastModified":"2026-11-12T07:16:46.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:46.750","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/products/service-desk/cve-2026-12507.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125836.json b/data/2026/CVE-2026-125836.json new file mode 100644 index 0000000000..a85735e8af --- /dev/null +++ b/data/2026/CVE-2026-125836.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"simple-jwt-login","product":"Simple JWT Login","vendor":"Nicu Micle","versions":[{"lessThanOrEqual":"3.6.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8."}],"id":"CVE-2026-125836","lastModified":"2026-11-12T08:16:41.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.267","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/simple-jwt-login/vulnerability/wordpress-simple-jwt-login-plugin-3-6-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"audit@patchstack.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-12591.json b/data/2026/CVE-2026-12591.json new file mode 100644 index 0000000000..e46834ee16 --- /dev/null +++ b/data/2026/CVE-2026-12591.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"M365 Manager Plus","vendor":"Zohocorp","versions":[{"lessThan":"4818","status":"affected","version":"0","versionType":"custom"}]}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing."}],"id":"CVE-2026-12591","lastModified":"2026-11-12T07:16:47.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]},"published":"2026-11-12T07:16:47.260","references":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","url":"https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-12591.html"}],"sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126991.json b/data/2026/CVE-2026-126991.json new file mode 100644 index 0000000000..b0371871ca --- /dev/null +++ b/data/2026/CVE-2026-126991.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"],"modules":["misp_modules/modules/expansion/wiki.py"],"product":"misp-modules","programFiles":["misp_modules/modules/expansion/wiki.py"],"repo":"https://github.com/MISP/misp-modules","vendor":"misp","versions":[{"lessThanOrEqual":"3.1.4","status":"affected","version":"unspecified","versionType":"semver"}]}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability. The handler function constructed a SPARQL query by directly concatenating the user-supplied text value into the query string without any escaping or parameterization: 'SELECT ?item WHERE { ?item rdfs:label\"' + request.get(\"text\") + '\" @en }'. An authenticated MISP user with access to the module could supply a crafted text attribute value containing SPARQL syntax (quotes, closing braces, UNION, SERVICE, LIMIT, etc.) to alter the structure of the query sent to the Wikidata SPARQL endpoint. This could allow an attacker to modify the query logic, extract unintended data, or cause the query to fail in ways that expose internal error details. Additionally, the old error handling path formatted raw exception objects into the response string ('wikidata API not accessible {}'.format(e)), potentially leaking internal information such as proxy credentials, query contents, or response bodies. The module also used a spoofed browser user-agent string and the deprecated Wikidata endpoint. The vulnerability required authenticated access to the MISP instance and the ability to invoke the wiki expansion module with a text attribute. The impact is limited to manipulation of the enrichment query and potential disclosure of internal error details; it does not directly compromise the MISP server or its stored data."}],"id":"CVE-2026-126991","lastModified":"2026-11-12T08:16:41.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","timestamp":"2026-11-12T05:54:11Z","version":"2.0.3"}}]},"published":"2026-11-12T08:16:41.480","references":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://github.com/MISP/misp-modules/pull/869"},{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","url":"https://misp.github.io/misp-modules/expansion/#wikidata-lookup"}],"sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-209"}],"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40820.json b/data/2026/CVE-2026-40820.json new file mode 100644 index 0000000000..85d3ee4f1c --- /dev/null +++ b/data/2026/CVE-2026-40820.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"mbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"mymbCONNECT24","vendor":"MB connect line","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"myREX24V2","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]},{"defaultStatus":"unaffected","product":"myREX24V2.virtual","vendor":"Helmholz","versions":[{"status":"affected","version":"2.20.0"}]}],"source":"info@cert.vde.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality."}],"id":"CVE-2026-40820","lastModified":"2026-11-12T08:16:41.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"info@cert.vde.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"info@cert.vde.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.760","references":[{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-044/"},{"source":"info@cert.vde.com","url":"https://www.certvde.com/en/advisories/VDE-2026-058/"}],"sourceIdentifier":"info@cert.vde.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"info@cert.vde.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-47832.json b/data/2026/CVE-2026-47832.json new file mode 100644 index 0000000000..7aaa28a127 --- /dev/null +++ b/data/2026/CVE-2026-47832.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"bosh-openstack-cpi-release","vendor":"CloudFoundry Foundation","versions":[{"lessThanOrEqual":"v55.0.4","status":"affected","version":"v55","versionType":"custom"}]}],"source":"security@vmware.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The vulnerability lies in the way application credentials are handled within the BOSH deployment.\nbosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)"}],"id":"CVE-2026-47832","lastModified":"2026-11-12T08:16:41.947","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@vmware.com","type":"Secondary"}]},"published":"2026-11-12T08:16:41.947","references":[{"source":"security@vmware.com","url":"https://www.cloudfoundry.org/blog/cve-2026-47832-openstack-application-credentials-logged-in-cleartext-to-bosh-debug-logs/"}],"sourceIdentifier":"security@vmware.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security@vmware.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-82292.json b/data/2026/CVE-2026-82292.json new file mode 100644 index 0000000000..becd163e5f --- /dev/null +++ b/data/2026/CVE-2026-82292.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"qt","vendor":"qt","versions":[{"lessThan":"6.8.9","status":"affected","version":"4.1.0","versionType":"python"},{"lessThan":"6.11.3","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase)."}],"id":"CVE-2026-82292","lastModified":"2026-11-12T08:16:42.167","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.9,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-12T08:16:42.167","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/757771"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-82292:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-8331.json b/data/2026/CVE-2026-8331.json new file mode 100644 index 0000000000..b2c3c9eb2f --- /dev/null +++ b/data/2026/CVE-2026-8331.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution."}],"id":"CVE-2026-8331","lastModified":"2026-11-12T07:16:47.963","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:47.963","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-8332.json b/data/2026/CVE-2026-8332.json new file mode 100644 index 0000000000..3b31dbbf35 --- /dev/null +++ b/data/2026/CVE-2026-8332.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials"}],"id":"CVE-2026-8332","lastModified":"2026-11-12T07:16:48.747","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:48.747","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-8333.json b/data/2026/CVE-2026-8333.json new file mode 100644 index 0000000000..15a50321a4 --- /dev/null +++ b/data/2026/CVE-2026-8333.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://www.microchip.com/en-us/products/clock-and-timing/systems/synchronization-management-monitoring/timepictra","defaultStatus":"unaffected","product":"TimePictra","vendor":"Microchip","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page"}],"id":"CVE-2026-8333","lastModified":"2026-11-12T07:16:49.413","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]},"published":"2026-11-12T07:16:49.413","references":[{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.gruppotim.it/en/footer/TIM-red-team.html"},{"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting-vulnerability"}],"sourceIdentifier":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-87772.json b/data/2026/CVE-2026-87772.json new file mode 100644 index 0000000000..a6e44f7051 --- /dev/null +++ b/data/2026/CVE-2026-87772.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pardus About","vendor":"TÜBİTAK BİLGEM Software Technologies Research Institute","versions":[{"lessThan":"1.2.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"iletisim@usom.gov.tr"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.\n\nThis issue affects Pardus About: before 1.2.5."}],"id":"CVE-2026-87772","lastModified":"2026-11-12T07:16:47.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"iletisim@usom.gov.tr","type":"Primary"}]},"published":"2026-11-12T07:16:47.580","references":[{"source":"iletisim@usom.gov.tr","url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1521"}],"sourceIdentifier":"iletisim@usom.gov.tr","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"iletisim@usom.gov.tr","type":"Primary"}]} diff --git a/data/2026/CVE-2026-96834.json b/data/2026/CVE-2026-96834.json index b3d36b6fe7..0fa1953bda 100644 --- a/data/2026/CVE-2026-96834.json +++ b/data/2026/CVE-2026-96834.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"give","product":"GiveWP","vendor":"Nexcess","versions":[{"changes":[{"at":"4.17.0","status":"unaffected"}],"lessThanOrEqual":"4.16.9","status":"affected","version":"n/a","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions."}],"id":"CVE-2026-96834","lastModified":"2026-09-30T14:18:12.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:04:07.496300Z","version":"2.0.3"}}]},"published":"2026-09-30T13:17:33.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"give","product":"GiveWP","vendor":"Liquid Web / StellarWP","versions":[{"changes":[{"at":"4.17.0","status":"unaffected"}],"lessThanOrEqual":"4.16.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9."}],"id":"CVE-2026-96834","lastModified":"2026-11-12T07:16:49.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-96834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-30T13:04:07.496300Z","version":"2.0.3"}}]},"published":"2026-09-30T13:17:33.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-4-16-9-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]} diff --git a/state/sync.json b/state/sync.json index f52496d3b4..8d7acc9e32 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1 +1 @@ -{"initial_complete":true,"last_run_counts":{"seen":7020,"skipped":39,"unchanged":6939,"written":42},"last_run_mode":"incremental","last_successful_end":"2026-11-12T06:42:28+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T06:47:45.194070+00:00"} +{"initial_complete":true,"last_run_counts":{"seen":6992,"skipped":39,"unchanged":6936,"written":17},"last_run_mode":"incremental","last_successful_end":"2026-11-12T08:42:30+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-12T08:47:41.247991+00:00"}