diff --git a/data/2025/CVE-2025-4637.json b/data/2025/CVE-2025-4637.json
index 1f35e44a45..0a33019796 100644
--- a/data/2025/CVE-2025-4637.json
+++ b/data/2025/CVE-2025-4637.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dlib","vendor":"davisking","versions":[{"changes":[{"at":"patch 19.24.7","status":"unaffected"}],"lessThan":"<19.24.7","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Divide By Zero vulnerability in davisking dlib allows \n\nremote attackers to cause a denial of service via a crafted file.\n\n.This issue affects dlib: before <19.24.7."},{"lang":"es","value":"La vulnerabilidad Divide By Zero en davisking dlib permite a atacantes remotos provocar una denegación de servicio a través de un archivo manipulado. Este problema afecta a dlib: anteriores a &lt;19.24.7."}],"id":"CVE-2025-4637","lastModified":"2026-11-13T16:06:41.693","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-15T14:26:49.348017Z","version":"2.0.3"}}]},"published":"2025-05-14T18:15:33.353","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3058"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dlib","vendor":"davisking","versions":[{"changes":[{"at":"patch 19.24.7","status":"unaffected"}],"lessThan":"<19.24.7","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dlib:dlib:*:*:*:*:*:*:*:*","matchCriteriaId":"754558A9-B482-4C4A-9F1D-56A913604B4F","versionEndExcluding":"19.24.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Divide By Zero vulnerability in davisking dlib allows \n\nremote attackers to cause a denial of service via a crafted file.\n\n.This issue affects dlib: before <19.24.7."},{"lang":"es","value":"La vulnerabilidad Divide By Zero en davisking dlib permite a atacantes remotos provocar una denegación de servicio a través de un archivo manipulado. Este problema afecta a dlib: anteriores a &lt;19.24.7."}],"id":"CVE-2025-4637","lastModified":"2026-11-13T17:02:41.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"MODERATE"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-15T14:26:49.348017Z","version":"2.0.3"}}]},"published":"2025-05-14T18:15:33.353","references":[{"source":"cve_disclosure@tech.gov.sg","tags":["Issue Tracking","Patch"],"url":"https://github.com/davisking/dlib/pull/3058"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-0178.json b/data/2026/CVE-2026-0178.json
index 7aa688d256..1d8b522bda 100644
--- a/data/2026/CVE-2026-0178.json
+++ b/data/2026/CVE-2026-0178.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0178","lastModified":"2026-11-13T05:17:46.510","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.623","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0178","lastModified":"2026-11-13T17:17:15.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:15.339608Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.623","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103769.json b/data/2026/CVE-2026-103769.json
index 62e2d6c63a..c5ca4db741 100644
--- a/data/2026/CVE-2026-103769.json
+++ b/data/2026/CVE-2026-103769.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"pdf-invoices-and-packing-slips-for-woocommerce","product":"PDF Invoices and Packing Slips For WooCommerce","vendor":"Acowebs","versions":[{"changes":[{"at":"1.4.11","status":"unaffected"}],"lessThanOrEqual":"1.4.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10."}],"id":"CVE-2026-103769","lastModified":"2026-11-13T15:17:28.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:28.850","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/pdf-invoices-and-packing-slips-for-woocommerce/vulnerability/wordpress-pdf-invoices-and-packing-slips-for-woocommerce-plugin-1-4-10-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"pdf-invoices-and-packing-slips-for-woocommerce","product":"PDF Invoices and Packing Slips For WooCommerce","vendor":"Acowebs","versions":[{"changes":[{"at":"1.4.11","status":"unaffected"}],"lessThanOrEqual":"1.4.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10."}],"id":"CVE-2026-103769","lastModified":"2026-11-13T17:17:15.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:06.444437Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:28.850","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/pdf-invoices-and-packing-slips-for-woocommerce/vulnerability/wordpress-pdf-invoices-and-packing-slips-for-woocommerce-plugin-1-4-10-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103870.json b/data/2026/CVE-2026-103870.json
index a3182739c3..42de0bb5ec 100644
--- a/data/2026/CVE-2026-103870.json
+++ b/data/2026/CVE-2026-103870.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.14-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.14-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.29.12-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.29.12-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service."}],"id":"CVE-2026-103870","lastModified":"2026-11-13T02:18:49.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-07T19:27:57.474141Z","version":"2.0.3"}}]},"published":"2026-10-07T06:16:35.373","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103870"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544606"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.26.9-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.14-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulp-rpm","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.27.14-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.29.12-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.29.12-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.32.15-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pulp-rpm","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.32.15-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulp-rpm-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service."}],"id":"CVE-2026-103870","lastModified":"2026-11-13T17:17:15.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-07T19:27:57.474141Z","version":"2.0.3"}}]},"published":"2026-10-07T06:16:35.373","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103870"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544606"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-103883.json b/data/2026/CVE-2026-103883.json
index 4b9c367570..0aa89734c7 100644
--- a/data/2026/CVE-2026-103883.json
+++ b/data/2026/CVE-2026-103883.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"6Storage Rentals","vendor":"sixstorage","versions":[{"lessThanOrEqual":"2.31.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests."}],"id":"CVE-2026-103883","lastModified":"2026-11-11T12:18:14.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-11T12:18:14.700","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_DashboardController.php#L14"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_DashboardController.php#L4126"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_SignInControllerSixStorage.php#L90"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Pages/Admin/Six_Storage_WpAdmin.php#L39"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Pages/Admin/Six_Storage_WpAdmin.php#L708"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b82539-8582-4bb4-ad4c-b626233b6075?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"6Storage Rentals","vendor":"sixstorage","versions":[{"lessThanOrEqual":"2.31.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 2.31.0. The vulnerability exists because the `six_storage_portal_registration()` AJAX handler — registered on `wp_ajax_six_storage_portal_plugin_registration` — performs no capability check and no nonce verification before writing the caller-supplied `six_storage_online_api_url` POST parameter to the site-wide option of the same name; the unauthenticated `six_storage_create_wp_user()` handler then redeems a transient seeded from that attacker-controlled URL's response and unconditionally calls `wp_set_current_user()` and `wp_set_auth_cookie()` with no ownership or credential verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to authenticate as any existing WordPress user — including any administrator whose email address is known or guessable — resulting in full site compromise. This issue represents an incomplete fix for a prior vulnerability: the 2.29.0 remediation moved the target email out of POST data into a server-side transient, but because any Subscriber can still overwrite the outbound API URL that populates that transient, the full authentication bypass chain remains exploitable in three AJAX requests."}],"id":"CVE-2026-103883","lastModified":"2026-11-13T18:17:25.023","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:16:10.217309Z","version":"2.0.3"}}]},"published":"2026-11-11T12:18:14.700","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_DashboardController.php#L14"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_DashboardController.php#L4126"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Base/Six_Storage_SignInControllerSixStorage.php#L90"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Pages/Admin/Six_Storage_WpAdmin.php#L39"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/6storage-rentals/tags/2.31.0/inc/Pages/Admin/Six_Storage_WpAdmin.php#L708"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/67b82539-8582-4bb4-ad4c-b626233b6075?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-104721.json b/data/2026/CVE-2026-104721.json
index 3e1118186e..93819edb48 100644
--- a/data/2026/CVE-2026-104721.json
+++ b/data/2026/CVE-2026-104721.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["logback-classic"],"platforms":["Java"],"product":"Logback-classic","vendor":"QOS.CH Sarl","versions":[{"lessThanOrEqual":"1.6.4","status":"affected","version":"0.9.14","versionType":"maven"},{"status":"unaffected","version":"1.6.5","versionType":"maven"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an \nMDC-based discriminator value flows unsanitized into a nested \nFileAppender path, letting an attacker who influences that MDC value \n(e.g. via an HTTP header)\n create and append log files outside the intended directory. \n\n\nThis issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques."}],"id":"CVE-2026-104721","lastModified":"2026-10-02T17:59:09.430","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"NOT_DEFINED","Safety":"PRESENT","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"MODERATE"},"source":"vulnerability@ncsc.ch","type":"Secondary"}]},"published":"2026-10-02T14:17:10.167","references":[{"source":"vulnerability@ncsc.ch","url":"https://logback.qos.ch/news.html#1.6.5"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["logback-classic"],"platforms":["Java"],"product":"Logback-classic","vendor":"QOS.CH Sarl","versions":[{"lessThanOrEqual":"1.6.4","status":"affected","version":"0.9.14","versionType":"maven"},{"status":"unaffected","version":"1.6.5","versionType":"maven"}]}],"source":"vulnerability@ncsc.ch"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an \nMDC-based discriminator value flows unsanitized into a nested \nFileAppender path, letting an attacker who influences that MDC value \n(e.g. via an HTTP header)\n create and append log files outside the intended directory. \n\n\nThis issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques."}],"id":"CVE-2026-104721","lastModified":"2026-11-13T17:17:15.980","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"NOT_DEFINED","Safety":"PRESENT","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"MODERATE"},"source":"vulnerability@ncsc.ch","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104721","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-02T13:58:10.145529Z","version":"2.0.3"}}]},"published":"2026-10-02T14:17:10.167","references":[{"source":"vulnerability@ncsc.ch","url":"https://logback.qos.ch/news.html#1.6.5"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-105986.json b/data/2026/CVE-2026-105986.json
index 3d8aae89a3..d8e7ddeea9 100644
--- a/data/2026/CVE-2026-105986.json
+++ b/data/2026/CVE-2026-105986.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role."}],"id":"CVE-2026-105986","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:17:52.560","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate  privileges via a percent-encoded role name or a self-assigned role."}],"id":"CVE-2026-105986","lastModified":"2026-11-13T17:17:16.117","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105986","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:41:27.080121Z","version":"2.0.3"}}]},"published":"2026-11-10T21:17:52.560","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-106471.json b/data/2026/CVE-2026-106471.json
index 2aad8b80a2..0f215ea078 100644
--- a/data/2026/CVE-2026-106471.json
+++ b/data/2026/CVE-2026-106471.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.7-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations."}],"id":"CVE-2026-106471","lastModified":"2026-11-13T00:20:06.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106471","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-07T15:45:22.236440Z","version":"2.0.3"}}]},"published":"2026-10-07T02:16:57.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-106471"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.7-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.7.7-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations."}],"id":"CVE-2026-106471","lastModified":"2026-11-13T17:17:16.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106471","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-07T15:45:22.236440Z","version":"2.0.3"}}]},"published":"2026-10-07T02:16:57.583","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-106471"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547044"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107152.json b/data/2026/CVE-2026-107152.json
index 216c187fa0..e3fd673a69 100644
--- a/data/2026/CVE-2026-107152.json
+++ b/data/2026/CVE-2026-107152.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"id":"CVE-2026-107152","lastModified":"2026-11-13T16:17:23.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:38:13.405900Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.680","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.3-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.9.4-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"rubygem-smart_proxy_dynflow","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.0.0-3.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task."}],"id":"CVE-2026-107152","lastModified":"2026-11-13T17:17:16.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:38:13.405900Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.680","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107152"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547374"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107360.json b/data/2026/CVE-2026-107360.json
index dafe98457b..d5ced3ba89 100644
--- a/data/2026/CVE-2026-107360.json
+++ b/data/2026/CVE-2026-107360.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state."}],"id":"CVE-2026-107360","lastModified":"2026-11-13T00:20:06.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.907","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107360"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547645"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"rubygem-safemode","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.5.0-3.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state."}],"id":"CVE-2026-107360","lastModified":"2026-11-13T17:17:16.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107360","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:34:51.731568Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:14.907","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107360"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547645"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-183"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107398.json b/data/2026/CVE-2026-107398.json
new file mode 100644
index 0000000000..581cf1d4e5
--- /dev/null
+++ b/data/2026/CVE-2026-107398.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"indico","vendor":"indico","versions":[{"status":"affected","version":"< 3.3.14"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an \"offline copy\" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14."}],"id":"CVE-2026-107398","lastModified":"2026-11-13T18:17:26.643","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:26.153","references":[{"source":"security-advisories@github.com","url":"https://github.com/indico/indico/releases/tag/v3.3.14"},{"source":"security-advisories@github.com","url":"https://github.com/indico/indico/security/advisories/GHSA-h57f-c9j4-577x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-107443.json b/data/2026/CVE-2026-107443.json
index b6b33c9715..c467e5339f 100644
--- a/data/2026/CVE-2026-107443.json
+++ b/data/2026/CVE-2026-107443.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users."}],"id":"CVE-2026-107443","lastModified":"2026-11-13T02:18:50.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:30:22.181500Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:15.120","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107443"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-96659"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547760"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.19-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users."}],"id":"CVE-2026-107443","lastModified":"2026-11-13T17:17:16.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T00:30:22.181500Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:15.120","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-107443"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-96659"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547760"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-107522.json b/data/2026/CVE-2026-107522.json
index 57ac0308db..84eb0528b7 100644
--- a/data/2026/CVE-2026-107522.json
+++ b/data/2026/CVE-2026-107522.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."}],"id":"CVE-2026-107522","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:29.357","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator."}],"id":"CVE-2026-107522","lastModified":"2026-11-13T17:17:16.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:38.249829Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:29.357","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-108187.json b/data/2026/CVE-2026-108187.json
index 4a8530aabd..077971d8b6 100644
--- a/data/2026/CVE-2026-108187.json
+++ b/data/2026/CVE-2026-108187.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Zoom Workplace","vendor":"Zoom Communications","versions":[{"lessThan":"7.1.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@zoom.us"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access."}],"id":"CVE-2026-108187","lastModified":"2026-11-11T05:19:17.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security@zoom.us","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T16:17:14.330","references":[{"source":"security@zoom.us","url":"https://www.zoom.com/en/trust/security-bulletin/zsb-26024"}],"sourceIdentifier":"security@zoom.us","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security@zoom.us","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Zoom Workplace","vendor":"Zoom Communications","versions":[{"lessThan":"7.1.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@zoom.us"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access."}],"id":"CVE-2026-108187","lastModified":"2026-11-13T17:17:16.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security@zoom.us","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:55:52.991470Z","version":"2.0.3"}}]},"published":"2026-11-10T16:17:14.330","references":[{"source":"security@zoom.us","url":"https://www.zoom.com/en/trust/security-bulletin/zsb-26024"}],"sourceIdentifier":"security@zoom.us","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security@zoom.us","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-109091.json b/data/2026/CVE-2026-109091.json
index 3ebc0d5648..b134eb5163 100644
--- a/data/2026/CVE-2026-109091.json
+++ b/data/2026/CVE-2026-109091.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote."}],"id":"CVE-2026-109091","lastModified":"2026-11-13T16:17:25.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T16:17:25.453","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"meissner@suse.de","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote."}],"id":"CVE-2026-109091","lastModified":"2026-11-13T17:17:17.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109091","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:52:51.086125Z","version":"2.0.3"}}]},"published":"2026-11-13T16:17:25.453","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/56e4ab6e8d94222480c8d7a28f530334059e3ab7"},{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/d88f0f7fdb2834c24feca63c0af5f46a57f4a04c"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"meissner@suse.de","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-109095.json b/data/2026/CVE-2026-109095.json
index 3a3dd8c3c4..cd42c5e67c 100644
--- a/data/2026/CVE-2026-109095.json
+++ b/data/2026/CVE-2026-109095.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data."}],"id":"CVE-2026-109095","lastModified":"2026-11-13T14:17:47.367","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}]},"published":"2026-11-13T14:17:47.260","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/99e647e914d947a791e92253a071955a9703647a"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"meissner@suse.de","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageName":"xwayland","product":"xwayland","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"24.1.15","status":"affected","version":"0","versionType":"rpm"}]},{"defaultStatus":"unaffected","packageName":"xorg-x11-server","product":"xorg-x11-server","repo":"https://gitlab.freedesktop.org/xorg/xserver/","vendor":"X.Org","versions":[{"lessThan":"21.1.26","status":"affected","version":"0","versionType":"rpm"}]}],"source":"meissner@suse.de"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data."}],"id":"CVE-2026-109095","lastModified":"2026-11-13T17:17:17.120","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"meissner@suse.de","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109095","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:05:55.156323Z","version":"2.0.3"}}]},"published":"2026-11-13T14:17:47.260","references":[{"source":"meissner@suse.de","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/99e647e914d947a791e92253a071955a9703647a"}],"sourceIdentifier":"meissner@suse.de","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"meissner@suse.de","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-111292.json b/data/2026/CVE-2026-111292.json
index 230770ce74..1f559550ec 100644
--- a/data/2026/CVE-2026-111292.json
+++ b/data/2026/CVE-2026-111292.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-111292","lastModified":"2026-11-10T21:18:21.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:38:16.530198Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:26.570","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111292"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-111292","lastModified":"2026-11-13T17:37:13.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:38:16.530198Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:26.570","references":[{"source":"secure@microsoft.com","tags":["Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111292"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-111456.json b/data/2026/CVE-2026-111456.json
index ad7345c8ad..e4911c7851 100644
--- a/data/2026/CVE-2026-111456.json
+++ b/data/2026/CVE-2026-111456.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.7-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer."}],"id":"CVE-2026-111456","lastModified":"2026-11-13T00:20:07.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T20:18:16.067","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-111456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553939"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.4.26-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.6.7-2.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"candlepin","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.7.7-2.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer."}],"id":"CVE-2026-111456","lastModified":"2026-11-13T17:17:17.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T20:18:16.067","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-111456"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553939"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-111547.json b/data/2026/CVE-2026-111547.json
index 283953f97d..ad5bc81c5a 100644
--- a/data/2026/CVE-2026-111547.json
+++ b/data/2026/CVE-2026-111547.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure."}],"id":"CVE-2026-111547","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:30.450","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure."}],"id":"CVE-2026-111547","lastModified":"2026-11-13T17:17:17.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:02:23.012212Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:30.450","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-112830.json b/data/2026/CVE-2026-112830.json
index 5f8923e407..6c152c0c8d 100644
--- a/data/2026/CVE-2026-112830.json
+++ b/data/2026/CVE-2026-112830.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"brizy","product":"Brizy","vendor":"Brizy","versions":[{"changes":[{"at":"2.8.26","status":"unaffected"}],"lessThanOrEqual":"2.8.25","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25."}],"id":"CVE-2026-112830","lastModified":"2026-11-13T13:17:48.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:17:48.380","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/brizy/vulnerability/wordpress-brizy-plugin-2-8-25-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"brizy","product":"Brizy","vendor":"Brizy","versions":[{"changes":[{"at":"2.8.26","status":"unaffected"}],"lessThanOrEqual":"2.8.25","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25."}],"id":"CVE-2026-112830","lastModified":"2026-11-13T17:17:17.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112830","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:30.635121Z","version":"2.0.3"}}]},"published":"2026-11-13T13:17:48.380","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/brizy/vulnerability/wordpress-brizy-plugin-2-8-25-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113521.json b/data/2026/CVE-2026-113521.json
index 7a596ee553..e672240b96 100644
--- a/data/2026/CVE-2026-113521.json
+++ b/data/2026/CVE-2026-113521.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"After Effects","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"After Effects","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"After Effects is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113521","lastModified":"2026-11-10T22:04:19.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T21:18:43.687","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"After Effects","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"After Effects","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"After Effects is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113521","lastModified":"2026-11-13T17:17:17.587","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:03:34.749585Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:43.687","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113549.json b/data/2026/CVE-2026-113549.json
index 4539e129fe..ba283e1775 100644
--- a/data/2026/CVE-2026-113549.json
+++ b/data/2026/CVE-2026-113549.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113549","lastModified":"2026-11-11T05:19:23.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:48.800","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113549","lastModified":"2026-11-13T18:10:17.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:48.800","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113551.json b/data/2026/CVE-2026-113551.json
index 9f96219e20..b932ed298e 100644
--- a/data/2026/CVE-2026-113551.json
+++ b/data/2026/CVE-2026-113551.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113551","lastModified":"2026-11-10T22:18:20.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:14:30.450030Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:48.963","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-657"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by a Violation of Secure Design Principles vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to gain elevated access. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-113551","lastModified":"2026-11-13T18:34:11.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:14:30.450030Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:48.963","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-657"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113553.json b/data/2026/CVE-2026-113553.json
index 235a721182..fd14b31140 100644
--- a/data/2026/CVE-2026-113553.json
+++ b/data/2026/CVE-2026-113553.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113553","lastModified":"2026-11-11T11:17:11.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:54.481312Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.157","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113553","lastModified":"2026-11-13T18:32:45.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113553","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:54.481312Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.157","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113555.json b/data/2026/CVE-2026-113555.json
index 55af219916..bae7d9bfb5 100644
--- a/data/2026/CVE-2026-113555.json
+++ b/data/2026/CVE-2026-113555.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113555","lastModified":"2026-11-11T05:19:24.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.320","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}],"id":"CVE-2026-113555","lastModified":"2026-11-13T18:30:55.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.320","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-113557.json b/data/2026/CVE-2026-113557.json
index 6980551688..bd1fd90eec 100644
--- a/data/2026/CVE-2026-113557.json
+++ b/data/2026/CVE-2026-113557.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113557","lastModified":"2026-11-10T22:04:19.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:11:19.666364Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.487","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113557","lastModified":"2026-11-13T18:30:05.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T21:11:19.666364Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.487","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-113558.json b/data/2026/CVE-2026-113558.json
index 3aee7435ea..c4415e9c0e 100644
--- a/data/2026/CVE-2026-113558.json
+++ b/data/2026/CVE-2026-113558.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113558","lastModified":"2026-11-11T11:17:12.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:47.976238Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.657","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"26.5","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"26.5.3","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Audition","vendor":"Adobe","versions":[{"lessThanOrEqual":"25.6.6","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"27.0","versionType":"semver"}]}],"source":"psirt@adobe.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"64CABA91-0C75-41A3-B366-74356DEDC3F4","versionEndIncluding":"25.6.6","vulnerable":true},{"criteria":"cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*","matchCriteriaId":"4BCECB97-7A5F-45E6-ACED-29A755C5B077","versionEndExcluding":"26.5.3","versionStartIncluding":"26.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false},{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."}],"id":"CVE-2026-113558","lastModified":"2026-11-13T18:29:27.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":6.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T04:56:47.976238Z","version":"2.0.3"}}]},"published":"2026-11-10T21:18:49.657","references":[{"source":"psirt@adobe.com","tags":["Vendor Advisory"],"url":"https://www.adobe.com/trust/security/products/audition/apsb26-102.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-115871.json b/data/2026/CVE-2026-115871.json
index e8e9fdc37e..8f52adccc1 100644
--- a/data/2026/CVE-2026-115871.json
+++ b/data/2026/CVE-2026-115871.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups","vendor":"renehermi","versions":[{"lessThanOrEqual":"4.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}],"id":"CVE-2026-115871","lastModified":"2026-11-13T10:17:25.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.070","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups","vendor":"renehermi","versions":[{"lessThanOrEqual":"4.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}],"id":"CVE-2026-115871","lastModified":"2026-11-13T17:17:17.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115871","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:40.600957Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:25.070","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116371.json b/data/2026/CVE-2026-116371.json
index 0050322bf5..ab320bf9bd 100644
--- a/data/2026/CVE-2026-116371.json
+++ b/data/2026/CVE-2026-116371.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:akuvox:akubela_hypanel_ps51:*:*:*:*:*:*:*:*"],"product":"Akubela HyPanel PS51","vendor":"Akuvox","versions":[{"status":"affected","version":"51.130.40.26"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. An official firmware patch is currently in development and will be released soon."}],"id":"CVE-2026-116371","lastModified":"2026-11-09T16:17:26.463","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116371","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T19:32:20.665876Z","version":"2.0.3"}}]},"published":"2026-10-26T17:17:26.117","references":[{"source":"cna@vuldb.com","url":"https://github.com/wisklr/Authentication-Bypass-Vulnerability-in-akubela-HyPanel-PS51.git"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-116371"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1013130"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/426335"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/426335/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:akuvox:akubela_hypanel_ps51:*:*:*:*:*:*:*:*"],"product":"Akubela HyPanel PS51","vendor":"Akuvox","versions":[{"status":"affected","version":"51.130.40.26"},{"status":"unaffected","version":"51.130.40.31"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The attack may be launched remotely. Upgrading to version 51.130.40.31 is sufficient to resolve this issue. It is recommended to upgrade the affected component."}],"id":"CVE-2026-116371","lastModified":"2026-11-13T18:17:26.707","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116371","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-26T19:32:20.665876Z","version":"2.0.3"}}]},"published":"2026-10-26T17:17:26.117","references":[{"source":"cna@vuldb.com","url":"https://akubela.com/securitycompliance/security-notice-improper-authentication-in-hypanel-ps51"},{"source":"cna@vuldb.com","url":"https://github.com/wisklr/Authentication-Bypass-Vulnerability-in-akubela-HyPanel-PS51.git"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-116371"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1013130"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/426335"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/426335/cti"},{"source":"cna@vuldb.com","url":"https://we.tl/t-OvOfjo6KwRRQeCe1"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116418.json b/data/2026/CVE-2026-116418.json
index df70cb57cb..8d596e0703 100644
--- a/data/2026/CVE-2026-116418.json
+++ b/data/2026/CVE-2026-116418.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116418","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:17:25.253","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116418","lastModified":"2026-11-13T17:17:17.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116418","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:34:56.742807Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:25.253","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116421.json b/data/2026/CVE-2026-116421.json
index c7cdcbd42a..663bc99c6f 100644
--- a/data/2026/CVE-2026-116421.json
+++ b/data/2026/CVE-2026-116421.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116421","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.540","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure."}],"id":"CVE-2026-116421","lastModified":"2026-11-13T18:17:26.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:46:19.221744Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:32.540","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116424.json b/data/2026/CVE-2026-116424.json
index 956baed304..c9eec6d7b2 100644
--- a/data/2026/CVE-2026-116424.json
+++ b/data/2026/CVE-2026-116424.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116424","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:32.920","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116424","lastModified":"2026-11-13T17:17:17.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:07.477284Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:32.920","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116425.json b/data/2026/CVE-2026-116425.json
index 53fe548b10..f55975f2b7 100644
--- a/data/2026/CVE-2026-116425.json
+++ b/data/2026/CVE-2026-116425.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116425","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.053","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116425","lastModified":"2026-11-13T18:17:27.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:47:50.490929Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:33.053","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116426.json b/data/2026/CVE-2026-116426.json
index 7f9efac8f3..072961892d 100644
--- a/data/2026/CVE-2026-116426.json
+++ b/data/2026/CVE-2026-116426.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-116426","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.173","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-116426","lastModified":"2026-11-13T17:17:18.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116426","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:04.716200Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:33.173","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116427.json b/data/2026/CVE-2026-116427.json
index d322dd797c..2cd8445de6 100644
--- a/data/2026/CVE-2026-116427.json
+++ b/data/2026/CVE-2026-116427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116427","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.297","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}],"id":"CVE-2026-116427","lastModified":"2026-11-13T17:17:18.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:00.741438Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:33.297","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116453.json b/data/2026/CVE-2026-116453.json
index 20e98dbbbe..cfad1537a9 100644
--- a/data/2026/CVE-2026-116453.json
+++ b/data/2026/CVE-2026-116453.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116453","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T09:17:33.930","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerScale InsightIQ","vendor":"Dell","versions":[{"lessThan":"6.4.1 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Unauthorized access."}],"id":"CVE-2026-116453","lastModified":"2026-11-13T18:17:27.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:47:06.281521Z","version":"2.0.3"}}]},"published":"2026-11-13T09:17:33.930","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-gb/000528934/dsa-2026-480-security-update-for-dell-powerscale-insightiq-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-116927.json b/data/2026/CVE-2026-116927.json
index 0a8b84953b..5f9c4404c9 100644
--- a/data/2026/CVE-2026-116927.json
+++ b/data/2026/CVE-2026-116927.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-116927","lastModified":"2026-11-10T20:18:07.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:56:34.229924Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:20.650","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116927"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-116927","lastModified":"2026-11-13T17:39:07.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:56:34.229924Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:20.650","references":[{"source":"secure@microsoft.com","tags":["Vendor Advisory","Patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-116927"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118292.json b/data/2026/CVE-2026-118292.json
index a36a0d28e8..89a65e2ba2 100644
--- a/data/2026/CVE-2026-118292.json
+++ b/data/2026/CVE-2026-118292.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118292","lastModified":"2026-11-10T20:18:19.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:46.166860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.447","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118292"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118292","lastModified":"2026-11-13T17:39:41.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118292","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:46.166860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.447","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118292"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118293.json b/data/2026/CVE-2026-118293.json
index 72ca8fec75..d7f878fa9f 100644
--- a/data/2026/CVE-2026-118293.json
+++ b/data/2026/CVE-2026-118293.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118293","lastModified":"2026-11-10T20:18:19.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:32.986035Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.600","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118293"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118293","lastModified":"2026-11-13T17:44:29.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:32.986035Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.600","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118293"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-191"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118294.json b/data/2026/CVE-2026-118294.json
index 0452351ede..a05348727d 100644
--- a/data/2026/CVE-2026-118294.json
+++ b/data/2026/CVE-2026-118294.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118294","lastModified":"2026-11-10T20:18:19.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:20.942730Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.743","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118294"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118294","lastModified":"2026-11-13T17:45:09.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118294","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:20.942730Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.743","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118294"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118295.json b/data/2026/CVE-2026-118295.json
index 139c245b07..ba7e71ff26 100644
--- a/data/2026/CVE-2026-118295.json
+++ b/data/2026/CVE-2026-118295.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118295","lastModified":"2026-11-10T20:18:19.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:08.819720Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.883","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118295"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118295","lastModified":"2026-11-13T17:45:50.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118295","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:08.819720Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:42.883","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118295"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-190"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118296.json b/data/2026/CVE-2026-118296.json
index edba7e33b6..19c0311eda 100644
--- a/data/2026/CVE-2026-118296.json
+++ b/data/2026/CVE-2026-118296.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118296","lastModified":"2026-11-10T20:18:19.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118296","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:56.964872Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.037","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118296"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118296","lastModified":"2026-11-13T17:47:47.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118296","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:56.964872Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.037","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118296"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118297.json b/data/2026/CVE-2026-118297.json
index 937dcc30f4..aef88a985a 100644
--- a/data/2026/CVE-2026-118297.json
+++ b/data/2026/CVE-2026-118297.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118297","lastModified":"2026-11-10T20:18:19.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:45.803255Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.217","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118297"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118297","lastModified":"2026-11-13T17:48:35.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118297","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:45.803255Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.217","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118297"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118298.json b/data/2026/CVE-2026-118298.json
index e6f65d5bd2..bbd8edce10 100644
--- a/data/2026/CVE-2026-118298.json
+++ b/data/2026/CVE-2026-118298.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118298","lastModified":"2026-11-10T20:18:19.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:34.513534Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.370","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118298"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118298","lastModified":"2026-11-13T17:49:12.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118298","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:34.513534Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.370","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118298"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118299.json b/data/2026/CVE-2026-118299.json
index 54cde1f73d..2f487c8aba 100644
--- a/data/2026/CVE-2026-118299.json
+++ b/data/2026/CVE-2026-118299.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118299","lastModified":"2026-11-10T20:18:19.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:23.421215Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.507","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118299"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118299","lastModified":"2026-11-13T17:50:06.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118299","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:23.421215Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.507","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118299"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118300.json b/data/2026/CVE-2026-118300.json
index 1966beedfe..eef1380fc8 100644
--- a/data/2026/CVE-2026-118300.json
+++ b/data/2026/CVE-2026-118300.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-118300","lastModified":"2026-11-10T20:18:20.093","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118300","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:12.006325Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.647","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118300"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network."}],"id":"CVE-2026-118300","lastModified":"2026-11-13T17:50:40.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118300","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:12.006325Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.647","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118300"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118301.json b/data/2026/CVE-2026-118301.json
index ae200d20af..6c242038cd 100644
--- a/data/2026/CVE-2026-118301.json
+++ b/data/2026/CVE-2026-118301.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118301","lastModified":"2026-11-10T20:18:20.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:00.501429Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.787","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118301"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118301","lastModified":"2026-11-13T17:51:42.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118301","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:37:00.501429Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.787","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118301"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118302.json b/data/2026/CVE-2026-118302.json
index 8e3209974a..f5950ce320 100644
--- a/data/2026/CVE-2026-118302.json
+++ b/data/2026/CVE-2026-118302.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118302","lastModified":"2026-11-10T20:18:20.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:49.298094Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.947","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118302"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118302","lastModified":"2026-11-13T17:52:31.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:49.298094Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:43.947","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118302"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118479.json b/data/2026/CVE-2026-118479.json
index 6325595d87..17d2727e11 100644
--- a/data/2026/CVE-2026-118479.json
+++ b/data/2026/CVE-2026-118479.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118479","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:23.717","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"Forms Hotfix for AEM 6.5 QuickStart - 1.0.12","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-118479","lastModified":"2026-11-13T17:17:18.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118479","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:51:17.240449Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:23.717","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118587.json b/data/2026/CVE-2026-118587.json
index 89a5e01064..4552b25b52 100644
--- a/data/2026/CVE-2026-118587.json
+++ b/data/2026/CVE-2026-118587.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerPress Podcasting plugin by Blubrry","vendor":"blubrry","versions":[{"lessThanOrEqual":"11.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own."}],"id":"CVE-2026-118587","lastModified":"2026-11-13T10:17:26.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:26.320","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L1240"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress?rev=3782100#trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3782099/powerpress/trunk/powerpress-player.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerPress Podcasting plugin by Blubrry","vendor":"blubrry","versions":[{"lessThanOrEqual":"11.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own."}],"id":"CVE-2026-118587","lastModified":"2026-11-13T17:17:18.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:35:44.792443Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:26.320","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L1240"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress/tags/11.18.0/powerpress-player.php#L135"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/powerpress?rev=3782100#trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3782099/powerpress/trunk/powerpress-player.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f5d3930f-d2da-4992-ad3a-228ffd7a5a6c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118700.json b/data/2026/CVE-2026-118700.json
index 333457a7be..521d504245 100644
--- a/data/2026/CVE-2026-118700.json
+++ b/data/2026/CVE-2026-118700.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118700","lastModified":"2026-11-10T20:18:20.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:36.999729Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.090","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118700"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118700","lastModified":"2026-11-13T17:53:10.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:36.999729Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.090","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118700"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118701.json b/data/2026/CVE-2026-118701.json
index 8ee0d2ac58..ca3daa3b94 100644
--- a/data/2026/CVE-2026-118701.json
+++ b/data/2026/CVE-2026-118701.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118701","lastModified":"2026-11-10T20:18:20.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:25.421663Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.233","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118701"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118701","lastModified":"2026-11-13T17:53:47.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118701","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:25.421663Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.233","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118701"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118702.json b/data/2026/CVE-2026-118702.json
index 4feef208ff..70b793540f 100644
--- a/data/2026/CVE-2026-118702.json
+++ b/data/2026/CVE-2026-118702.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118702","lastModified":"2026-11-10T20:18:20.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:13.674902Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.377","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118702"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118702","lastModified":"2026-11-13T17:54:35.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118702","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:36:13.674902Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.377","references":[{"source":"secure@microsoft.com","tags":["Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118702"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118703.json b/data/2026/CVE-2026-118703.json
index 96db34b04d..9ecbdd8aa6 100644
--- a/data/2026/CVE-2026-118703.json
+++ b/data/2026/CVE-2026-118703.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118703","lastModified":"2026-11-10T20:18:20.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:59.822947Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.553","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118703"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118703","lastModified":"2026-11-13T17:55:09.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:59.822947Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:44.553","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118703"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118704.json b/data/2026/CVE-2026-118704.json
index 7a661a1a2b..29a69977a4 100644
--- a/data/2026/CVE-2026-118704.json
+++ b/data/2026/CVE-2026-118704.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118704","lastModified":"2026-11-10T20:18:20.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118704","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:48.486836Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.403","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118704"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118704","lastModified":"2026-11-13T17:55:45.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118704","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:48.486836Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.403","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118704"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118705.json b/data/2026/CVE-2026-118705.json
index 901f123323..2a537db1cb 100644
--- a/data/2026/CVE-2026-118705.json
+++ b/data/2026/CVE-2026-118705.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118705","lastModified":"2026-11-10T20:18:21.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:37.439554Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.573","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118705"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118705","lastModified":"2026-11-13T17:56:23.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118705","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:37.439554Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.573","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118705"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118706.json b/data/2026/CVE-2026-118706.json
index 6688fe25d6..115707f210 100644
--- a/data/2026/CVE-2026-118706.json
+++ b/data/2026/CVE-2026-118706.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118706","lastModified":"2026-11-10T20:18:21.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:24.792695Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.740","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118706"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118706","lastModified":"2026-11-13T17:57:43.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:24.792695Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.740","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118706"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118707.json b/data/2026/CVE-2026-118707.json
index 0f9d2d3525..5adfd945c1 100644
--- a/data/2026/CVE-2026-118707.json
+++ b/data/2026/CVE-2026-118707.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118707","lastModified":"2026-11-10T20:18:21.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:12.989704Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.890","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118707"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118707","lastModified":"2026-11-13T17:58:23.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:12.989704Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:45.890","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118707"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118708.json b/data/2026/CVE-2026-118708.json
index 4f5db4ef6b..2687dc7397 100644
--- a/data/2026/CVE-2026-118708.json
+++ b/data/2026/CVE-2026-118708.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118708","lastModified":"2026-11-10T20:18:21.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:00.798670Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.053","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118708"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118708","lastModified":"2026-11-13T17:58:58.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:35:00.798670Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.053","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118708"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-763"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118709.json b/data/2026/CVE-2026-118709.json
index f6c53e6352..dbe04e860f 100644
--- a/data/2026/CVE-2026-118709.json
+++ b/data/2026/CVE-2026-118709.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118709","lastModified":"2026-11-10T20:18:21.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:49.056160Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.203","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118709"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118709","lastModified":"2026-11-13T18:00:55.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118709","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:49.056160Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.203","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118709"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118710.json b/data/2026/CVE-2026-118710.json
index 9aea1a19ca..269bf64536 100644
--- a/data/2026/CVE-2026-118710.json
+++ b/data/2026/CVE-2026-118710.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118710","lastModified":"2026-11-10T20:18:21.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:36.993716Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.360","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118710"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118710","lastModified":"2026-11-13T18:02:00.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118710","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:36.993716Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.360","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118710"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-118711.json b/data/2026/CVE-2026-118711.json
index 7aefab62a8..f965016dab 100644
--- a/data/2026/CVE-2026-118711.json
+++ b/data/2026/CVE-2026-118711.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118711","lastModified":"2026-11-10T20:18:21.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:25.655569Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.510","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118711"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office 365 for Mac","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"1.0.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"16.0.14334.21048","status":"affected","version":"16.0.1","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"16.0.17932.21140","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2021","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.1","versionType":"custom"}]},{"product":"Microsoft Office LTSC for Mac 2024","vendor":"Microsoft","versions":[{"lessThan":"16.115.26110837","status":"affected","version":"16.0.0","versionType":"custom"}]},{"product":"Office Online Server","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20236","status":"affected","version":"16.0.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_365:-:*:*:*:*:macos:*:*","matchCriteriaId":"12418BDE-FA2E-4BBF-8E47-45C505399898","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"0DB3EBBF-E0C4-4D5A-8D22-107463AD1DE4","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:macos:-:*","matchCriteriaId":"589B470B-9C2E-41E2-A44D-D8CCB4D2F933","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4DD2ABC1-2A1C-4177-B13B-509F329E4228","versionEndExcluding":"16.0.10417.20236","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network."}],"id":"CVE-2026-118711","lastModified":"2026-11-13T18:03:09.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118711","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:34:25.655569Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:46.510","references":[{"source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118711"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secure@microsoft.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119512.json b/data/2026/CVE-2026-119512.json
index ebe3e12f3b..7fbc692569 100644
--- a/data/2026/CVE-2026-119512.json
+++ b/data/2026/CVE-2026-119512.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.3","status":"unaffected"}],"lessThanOrEqual":"4.18.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2."}],"id":"CVE-2026-119512","lastModified":"2026-11-13T15:17:32.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.490","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.3","status":"unaffected"}],"lessThanOrEqual":"4.18.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2."}],"id":"CVE-2026-119512","lastModified":"2026-11-13T17:17:18.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:58:32.986323Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:32.490","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-2-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119517.json b/data/2026/CVE-2026-119517.json
index f5726b0930..6e8ea6d7b6 100644
--- a/data/2026/CVE-2026-119517.json
+++ b/data/2026/CVE-2026-119517.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"catna-woo-name-your-price-and-offers","product":"Catna – Woo Name Your Price and Offers","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.0.4","status":"unaffected"}],"lessThanOrEqual":"2.0.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3."}],"id":"CVE-2026-119517","lastModified":"2026-11-13T15:17:32.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:32.630","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/catna-woo-name-your-price-and-offers/vulnerability/wordpress-catna-woo-name-your-price-and-offers-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"catna-woo-name-your-price-and-offers","product":"Catna – Woo Name Your Price and Offers","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.0.4","status":"unaffected"}],"lessThanOrEqual":"2.0.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3."}],"id":"CVE-2026-119517","lastModified":"2026-11-13T17:17:18.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119517","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:55:22.454803Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:32.630","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/catna-woo-name-your-price-and-offers/vulnerability/wordpress-catna-woo-name-your-price-and-offers-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-119528.json b/data/2026/CVE-2026-119528.json
index 05ea16e3d3..8715a6efca 100644
--- a/data/2026/CVE-2026-119528.json
+++ b/data/2026/CVE-2026-119528.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:3.0.4-8.el9_9.6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:3.0.4-4.el9_8.16","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gimp","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gimp:2.8/gimp","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution."}],"id":"CVE-2026-119528","lastModified":"2026-11-12T06:17:12.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-10-30T14:16:45.143","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98532"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99154"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119528"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563900"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:3.0.4-8.el9_9.6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:3.0.4-4.el9_8.16","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"gimp","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gimp","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gimp","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"gimp:2.8/gimp","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution."}],"id":"CVE-2026-119528","lastModified":"2026-11-13T18:17:27.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-30T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-10-30T14:16:45.143","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98532"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99154"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119528"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563900"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120399.json b/data/2026/CVE-2026-120399.json
index 60c7c826da..262cc81cc6 100644
--- a/data/2026/CVE-2026-120399.json
+++ b/data/2026/CVE-2026-120399.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-api-rhel10","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-api-rhel9","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-remote-access-rhel10","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-remote-access-rhel9","product":"Red Hat Edge Manager 1","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections."}],"id":"CVE-2026-120399","lastModified":"2026-11-10T14:17:14.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-10T14:17:14.300","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-120399"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564888"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1322"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-api-rhel10","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-api-rhel9","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-remote-access-rhel10","product":"Red Hat Edge Manager 1","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:edge_manager:1"],"defaultStatus":"affected","packageName":"rhem/flightctl-remote-access-rhel9","product":"Red Hat Edge Manager 1","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections."}],"id":"CVE-2026-120399","lastModified":"2026-11-13T17:17:18.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120399","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:15:44.789102Z","version":"2.0.3"}}]},"published":"2026-11-10T14:17:14.300","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-120399"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564888"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1322"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120688.json b/data/2026/CVE-2026-120688.json
index 303de17b74..2f585c33ac 100644
--- a/data/2026/CVE-2026-120688.json
+++ b/data/2026/CVE-2026-120688.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EZ SQL Reports Shortcode Widget and DB Backup","vendor":"scheeeli","versions":[{"lessThanOrEqual":"5.25.25","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation."}],"id":"CVE-2026-120688","lastModified":"2026-11-13T10:17:27.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.137","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L385"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L419"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L517"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791213/elisqlreports/trunk/index.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EZ SQL Reports Shortcode Widget and DB Backup","vendor":"scheeeli","versions":[{"lessThanOrEqual":"5.25.25","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation."}],"id":"CVE-2026-120688","lastModified":"2026-11-13T17:17:18.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120688","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:36:52.976497Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:27.137","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L385"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L419"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/tags/5.25.25/index.php#L517"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/elisqlreports/trunk"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3791213/elisqlreports/trunk/index.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/376eec5d-a629-4765-8ace-09e21bf3c2e8?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120835.json b/data/2026/CVE-2026-120835.json
index 1b85aeac3d..a5e0b00ead 100644
--- a/data/2026/CVE-2026-120835.json
+++ b/data/2026/CVE-2026-120835.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"affi-affiliate-marketing-for-woo","product":"AFFI – Affiliate Marketing for WooCommerce","vendor":"VillaTheme","versions":[{"changes":[{"at":"1.0.12","status":"unaffected"}],"lessThanOrEqual":"1.0.11","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11."}],"id":"CVE-2026-120835","lastModified":"2026-11-13T15:17:33.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:33.290","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"affi-affiliate-marketing-for-woo","product":"AFFI – Affiliate Marketing for WooCommerce","vendor":"VillaTheme","versions":[{"changes":[{"at":"1.0.12","status":"unaffected"}],"lessThanOrEqual":"1.0.11","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11."}],"id":"CVE-2026-120835","lastModified":"2026-11-13T17:17:18.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:58:46.355166Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:33.290","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/affi-affiliate-marketing-for-woo/vulnerability/wordpress-affi-affiliate-marketing-for-woocommerce-plugin-1-0-11-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120981.json b/data/2026/CVE-2026-120981.json
index 9d56afd4f2..445d097c4e 100644
--- a/data/2026/CVE-2026-120981.json
+++ b/data/2026/CVE-2026-120981.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers."}],"id":"CVE-2026-120981","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.360","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["7280R3 Series","7500R3 Series","7800R3 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers."}],"id":"CVE-2026-120981","lastModified":"2026-11-13T18:17:27.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:32:00.464058Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.360","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120982.json b/data/2026/CVE-2026-120982.json
index a3111b0ce8..61108950bd 100644
--- a/data/2026/CVE-2026-120982.json
+++ b/data/2026/CVE-2026-120982.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding."}],"id":"CVE-2026-120982","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding."}],"id":"CVE-2026-120982","lastModified":"2026-11-13T18:17:27.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120982","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:37:26.523551Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.507","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-120983.json b/data/2026/CVE-2026-120983.json
index 2224bbfcaa..0a64b72e71 100644
--- a/data/2026/CVE-2026-120983.json
+++ b/data/2026/CVE-2026-120983.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","7010TX Series","7320X Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7300X/X3 Series","7050X3/X4 Series","750X Series","7250 Series","7358X4 Series","7368X4 Series","7388X5 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU."}],"id":"CVE-2026-120983","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.653","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","7010TX Series","7320X Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7300X/X3 Series","7050X3/X4 Series","750X Series","7250 Series","7358X4 Series","7368X4 Series","7388X5 Series"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.9M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU."}],"id":"CVE-2026-120983","lastModified":"2026-11-13T18:17:27.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120983","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:35:59.580472Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.653","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25037-security-advisory-0215"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121286.json b/data/2026/CVE-2026-121286.json
index a0612832b7..629edbe572 100644
--- a/data/2026/CVE-2026-121286.json
+++ b/data/2026/CVE-2026-121286.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.22.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device."}],"id":"CVE-2026-121286","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:53.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.22.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device."}],"id":"CVE-2026-121286","lastModified":"2026-11-13T18:17:27.800","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121286","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:35:26.850369Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:53.800","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25035-security-advisory-0213"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121288.json b/data/2026/CVE-2026-121288.json
index ebccc71857..7f1fabcd2c 100644
--- a/data/2026/CVE-2026-121288.json
+++ b/data/2026/CVE-2026-121288.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity."}],"id":"CVE-2026-121288","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.130","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity."}],"id":"CVE-2026-121288","lastModified":"2026-11-13T18:17:27.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:34:24.792520Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:54.130","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-303"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121289.json b/data/2026/CVE-2026-121289.json
index f0d4bff144..95f04aceac 100644
--- a/data/2026/CVE-2026-121289.json
+++ b/data/2026/CVE-2026-121289.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.25.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."}],"id":"CVE-2026-121289","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.283","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.25.1F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.\n\nSuccessful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system."}],"id":"CVE-2026-121289","lastModified":"2026-11-13T18:17:28.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121289","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:33:36.524401Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:54.283","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121290.json b/data/2026/CVE-2026-121290.json
index 33b2e7c16a..33695c8abc 100644
--- a/data/2026/CVE-2026-121290.json
+++ b/data/2026/CVE-2026-121290.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts."}],"id":"CVE-2026-121290","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.447","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-420"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts."}],"id":"CVE-2026-121290","lastModified":"2026-11-13T18:17:28.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121290","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:32:45.993447Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:54.447","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25031-security-advisory-0209"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-420"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121291.json b/data/2026/CVE-2026-121291.json
index 606d562bab..54724ba5bf 100644
--- a/data/2026/CVE-2026-121291.json
+++ b/data/2026/CVE-2026-121291.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."}],"id":"CVE-2026-121291","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.597","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates."}],"id":"CVE-2026-121291","lastModified":"2026-11-13T18:17:29.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121291","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:27:27.385133Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:54.597","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121292.json b/data/2026/CVE-2026-121292.json
index 79f6978cad..9f54a1a1e6 100644
--- a/data/2026/CVE-2026-121292.json
+++ b/data/2026/CVE-2026-121292.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.24.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging."}],"id":"CVE-2026-121292","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:54.743","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"status":"affected","version":"4.37.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.24.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging."}],"id":"CVE-2026-121292","lastModified":"2026-11-13T18:17:29.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121292","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:31:16.817205Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:54.743","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121293.json b/data/2026/CVE-2026-121293.json
index afcdbc50a9..d7efc3d5d0 100644
--- a/data/2026/CVE-2026-121293.json
+++ b/data/2026/CVE-2026-121293.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts."}],"id":"CVE-2026-121293","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.293","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts."}],"id":"CVE-2026-121293","lastModified":"2026-11-13T18:17:30.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121293","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:30:37.445774Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:55.293","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121294.json b/data/2026/CVE-2026-121294.json
index bd6acbc046..273b8fdbde 100644
--- a/data/2026/CVE-2026-121294.json
+++ b/data/2026/CVE-2026-121294.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.29.0F","status":"affected","version":"4.28.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts."}],"id":"CVE-2026-121294","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.547","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.29.0F","status":"affected","version":"4.28.2F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts."}],"id":"CVE-2026-121294","lastModified":"2026-11-13T18:17:30.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121294","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:30:05.947981Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:55.547","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121295.json b/data/2026/CVE-2026-121295.json
index b9048d9ff8..aa296a7e6b 100644
--- a/data/2026/CVE-2026-121295.json
+++ b/data/2026/CVE-2026-121295.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot."}],"id":"CVE-2026-121295","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.750","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7280R/R2/R3/R4 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot."}],"id":"CVE-2026-121295","lastModified":"2026-11-13T18:17:30.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121295","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:29:15.234942Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:55.750","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25045-security-advisory-0223"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121367.json b/data/2026/CVE-2026-121367.json
index debeaef63a..c7d2490808 100644
--- a/data/2026/CVE-2026-121367.json
+++ b/data/2026/CVE-2026-121367.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"status":"affected","version":"4.37.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device."}],"id":"CVE-2026-121367","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:55.933","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.33.0F","status":"affected","version":"1.0.0","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"status":"affected","version":"4.37.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication.\n\nSuccessful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device."}],"id":"CVE-2026-121367","lastModified":"2026-11-13T18:17:30.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":6.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121367","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:28:16.798719Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:55.933","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-440"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121368.json b/data/2026/CVE-2026-121368.json
index eec022be60..89c28bcc1c 100644
--- a/data/2026/CVE-2026-121368.json
+++ b/data/2026/CVE-2026-121368.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot."}],"id":"CVE-2026-121368","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.123","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["710 Series","720D Series","720XP/722XPM Series","750X Series","7010TX Series","7020R/R4 Series","7130 Series running EOS","7170 Series","7050X3/X4 Series","7060X/X2/X4/X5/X6/XE7 Series","7260X/X3 Series","7280R/R2/R3/R4 Series","7300X/X3 Series","7320X Series","7358X4 Series","7368X4 Series","7388X5 Series","7500R/R2/R3 Series","7800R3/R4 Series","7700R4 Series","AWE 5000 Series","AWE 7200R Series","ZTX-7200 Series","CloudEOS","cEOS-lab","vEOS-lab","CloudVision eXchange, virtual or physical appliance"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.36.2F","status":"affected","version":"4.36.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.8M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.10M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"1.0.0","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot."}],"id":"CVE-2026-121368","lastModified":"2026-11-13T18:17:30.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121368","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:25:36.532360Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.123","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25028-security-advisory-0206"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121369.json b/data/2026/CVE-2026-121369.json
index b08d10f80f..0c1f826c54 100644
--- a/data/2026/CVE-2026-121369.json
+++ b/data/2026/CVE-2026-121369.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.2F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1M","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}],"id":"CVE-2026-121369","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}]},"published":"2026-11-10T20:18:56.303","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["750X Series (CCS-750XM-48TX-LC, CCS-750XPM-48NH-LC, CCS-750XPM-48TXH-LC)"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.2F","versionType":"custom"},{"lessThanOrEqual":"4.35.6M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1M","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"source":"psirt@arista.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot."}],"id":"CVE-2026-121369","lastModified":"2026-11-13T17:17:19.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":4.0,"source":"psirt@arista.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@arista.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:42:27.455014Z","version":"2.0.3"}}]},"published":"2026-11-10T20:18:56.303","references":[{"source":"psirt@arista.com","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225"}],"sourceIdentifier":"psirt@arista.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"psirt@arista.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121776.json b/data/2026/CVE-2026-121776.json
index e32fbd1400..273d471a62 100644
--- a/data/2026/CVE-2026-121776.json
+++ b/data/2026/CVE-2026-121776.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"content-protector","product":"Passster","vendor":"WP Chill","versions":[{"changes":[{"at":"4.3.21","status":"unaffected"}],"lessThanOrEqual":"4.3.20","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20."}],"id":"CVE-2026-121776","lastModified":"2026-11-13T15:17:33.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:33.560","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/content-protector/vulnerability/wordpress-passster-plugin-4-3-20-broken-access-control-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"content-protector","product":"Passster","vendor":"WP Chill","versions":[{"changes":[{"at":"4.3.21","status":"unaffected"}],"lessThanOrEqual":"4.3.20","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20."}],"id":"CVE-2026-121776","lastModified":"2026-11-13T17:17:19.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121776","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:58:25.662966Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:33.560","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/content-protector/vulnerability/wordpress-passster-plugin-4-3-20-broken-access-control-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121809.json b/data/2026/CVE-2026-121809.json
new file mode 100644
index 0000000000..c796710fe9
--- /dev/null
+++ b/data/2026/CVE-2026-121809.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"38955f1392cbf08eef231a347348445410455c85","status":"affected","version":"0332faae5f5e132314794dbfdae5edecbccea292","versionType":"git"}]},{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"grpc","packageURL":"pkg:hex/grpc","product":"grpc","programFiles":["lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.0.0","status":"affected","version":"0.3.1","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc","programFiles":["lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':read_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"0332faae5f5e132314794dbfdae5edecbccea292","status":"affected","version":"6d8a09ad919e208fb600538ac8b19bd733a04310","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.\n\nGRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0."}],"id":"CVE-2026-121809","lastModified":"2026-11-13T17:17:19.310","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-13T17:17:19.310","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-121809.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/38955f1392cbf08eef231a347348445410455c85"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/6d8a09ad919e208fb600538ac8b19bd733a04310"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-c2h9-f9cc-27xh"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-121809"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-835"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121890.json b/data/2026/CVE-2026-121890.json
index 0270018913..9d4b43ca68 100644
--- a/data/2026/CVE-2026-121890.json
+++ b/data/2026/CVE-2026-121890.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121890","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:26.350","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed."}],"id":"CVE-2026-121890","lastModified":"2026-11-13T17:17:19.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:37:54.147961Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:26.350","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-121910.json b/data/2026/CVE-2026-121910.json
index 5e25fd84b8..eec8b1801a 100644
--- a/data/2026/CVE-2026-121910.json
+++ b/data/2026/CVE-2026-121910.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-121910","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:27.663","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.8","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.8.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.9","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.9.a","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.10.f","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.11","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.11.i","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Connect","vendor":"Adobe","versions":[{"lessThanOrEqual":"12.12","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"12.12.a","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Connect is affected by a Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed."}],"id":"CVE-2026-121910","lastModified":"2026-11-13T17:17:19.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:40:15.941310Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:27.663","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/connect/apsb26-191.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-122097.json b/data/2026/CVE-2026-122097.json
index c15397c7db..b6d3c304e3 100644
--- a/data/2026/CVE-2026-122097.json
+++ b/data/2026/CVE-2026-122097.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-122097","lastModified":"2026-11-10T22:18:28.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:28.053","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page."}],"id":"CVE-2026-122097","lastModified":"2026-11-13T17:17:19.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122097","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:26:57.740622Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:28.053","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123039.json b/data/2026/CVE-2026-123039.json
index e2a651b42d..cd0ed43e9d 100644
--- a/data/2026/CVE-2026-123039.json
+++ b/data/2026/CVE-2026-123039.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-12T20:04:52.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Quantum Security Gateway","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]},{"product":"Quantum Security Management","vendor":"checkpoint","versions":[{"status":"affected","version":"R82.10 with Jumbo Hotfix Take 50 or below"},{"status":"affected","version":"R82.20 with Jumbo Hotfix Take 10 or below"},{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"source":"cve@checkpoint.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root."}],"id":"CVE-2026-123039","lastModified":"2026-11-13T17:17:19.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@checkpoint.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123039","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T11:43:47.126754Z","version":"2.0.3"}}]},"published":"2026-11-12T14:17:24.233","references":[{"source":"cve@checkpoint.com","url":"https://support.checkpoint.com/results/sk/sk1000362"}],"sourceIdentifier":"cve@checkpoint.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"},{"lang":"en","value":"CWE-862"}],"source":"cve@checkpoint.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123177.json b/data/2026/CVE-2026-123177.json
new file mode 100644
index 0000000000..376d4ceb80
--- /dev/null
+++ b/data/2026/CVE-2026-123177.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"dnf5","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion."}],"id":"CVE-2026-123177","lastModified":"2026-11-13T18:17:30.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":5.8,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-13T18:17:30.780","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-123177"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2567426"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"secalert@redhat.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-123258.json b/data/2026/CVE-2026-123258.json
index e3ddd5ad7a..98f9573ec6 100644
--- a/data/2026/CVE-2026-123258.json
+++ b/data/2026/CVE-2026-123258.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-123258","lastModified":"2026-11-12T16:57:14.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.120","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Adobe Experience Manager as a Cloud Service","vendor":"Adobe","versions":[{"lessThanOrEqual":"2026.10.29023","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"2026.10.29251","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5.25","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 SP25 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Adobe Experience Manager 6.5 LTS","vendor":"Adobe","versions":[{"lessThanOrEqual":"6.5 LTS SP3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"6.5 LTS SP3 - Cumulative Hotfix for GRANITE-75398","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed."}],"id":"CVE-2026-123258","lastModified":"2026-11-13T17:17:20.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123258","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:41:15.802464Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.120","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/experience-manager/apsb26-189.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123260.json b/data/2026/CVE-2026-123260.json
index 87457d0ae5..ee22d85f1d 100644
--- a/data/2026/CVE-2026-123260.json
+++ b/data/2026/CVE-2026-123260.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-123260","lastModified":"2026-11-10T22:18:29.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"psirt@adobe.com","type":"Primary"}]},"published":"2026-11-10T22:18:29.383","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Credentials Rust SDK","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2pa-v0.91.10","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2pa-v0.91.11","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"C2PA Tool","vendor":"Adobe","versions":[{"lessThanOrEqual":"c2patool-v0.28.5","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"c2patool-v0.28.6","versionType":"custom"}]}],"source":"psirt@adobe.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction."}],"id":"CVE-2026-123260","lastModified":"2026-11-13T17:17:20.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.0,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.5,"impactScore":1.4,"source":"psirt@adobe.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-123260","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:24:35.288688Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:29.383","references":[{"source":"psirt@adobe.com","url":"https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html"}],"sourceIdentifier":"psirt@adobe.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"psirt@adobe.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-123965.json b/data/2026/CVE-2026-123965.json
new file mode 100644
index 0000000000..e15cea4d7a
--- /dev/null
+++ b/data/2026/CVE-2026-123965.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Jet Admin Cloud Platform","vendor":"Jet Admin","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[{"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026."}],"id":"CVE-2026-123965","lastModified":"2026-11-13T18:17:30.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.3,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-123965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:31:49.700138Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:30.933","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-317-01.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-123965"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.jetadmin.io/"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.jetadmin.io/changelog"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124041.json b/data/2026/CVE-2026-124041.json
new file mode 100644
index 0000000000..d5f1f83af3
--- /dev/null
+++ b/data/2026/CVE-2026-124041.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"WebPro","vendor":"Catalis","versions":[{"status":"affected","version":"5.0"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and  taxpayer information."}],"id":"CVE-2026-124041","lastModified":"2026-11-13T18:17:31.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-124041","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:33:16.963894Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:31.117","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-310-01.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-124041"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124218.json b/data/2026/CVE-2026-124218.json
index 5ced428240..f6af3c7277 100644
--- a/data/2026/CVE-2026-124218.json
+++ b/data/2026/CVE-2026-124218.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Drag and Drop File Upload for Elementor Forms","vendor":"addonsorg","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the \"yeepdf_not_save\" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path."}],"id":"CVE-2026-124218","lastModified":"2026-11-13T10:17:28.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:27.993","references":[{"source":"security@wordfence.com","url":"https://downloads.wordpress.org/plugin/drag-and-drop-file-upload-for-elementor-forms.1.6.3.zip"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L724"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L764"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L838"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L849"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Drag and Drop File Upload for Elementor Forms","vendor":"addonsorg","versions":[{"lessThanOrEqual":"1.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is reachable when the \"yeepdf_not_save\" privacy option is enabled, a commonly used production setting that triggers the remove_files() cleanup path."}],"id":"CVE-2026-124218","lastModified":"2026-11-13T17:17:20.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124218","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:38:58.346734Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:27.993","references":[{"source":"security@wordfence.com","url":"https://downloads.wordpress.org/plugin/drag-and-drop-file-upload-for-elementor-forms.1.6.3.zip"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L724"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L764"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L838"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/drag-and-drop-file-upload-for-elementor-forms/tags/1.6.2/fields/file_upload.php#L849"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ee73bfb0-843c-4b4a-b513-3980c1cefac1?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124265.json b/data/2026/CVE-2026-124265.json
index e5b4ae8676..918948685e 100644
--- a/data/2026/CVE-2026-124265.json
+++ b/data/2026/CVE-2026-124265.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.2","status":"unaffected"}],"lessThanOrEqual":"4.18.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1."}],"id":"CVE-2026-124265","lastModified":"2026-11-13T15:17:36.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.133","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"newsletters-lite","product":"Newsletters","vendor":"Tribulant Software","versions":[{"changes":[{"at":"4.18.2","status":"unaffected"}],"lessThanOrEqual":"4.18.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1."}],"id":"CVE-2026-124265","lastModified":"2026-11-13T17:17:20.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124265","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:35.862751Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.133","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/newsletters-lite/vulnerability/wordpress-newsletters-plugin-4-18-1-sql-injection-vulnerability-2?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124267.json b/data/2026/CVE-2026-124267.json
index 8eefb7190a..b7897f56aa 100644
--- a/data/2026/CVE-2026-124267.json
+++ b/data/2026/CVE-2026-124267.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"gmail-smtp","product":"Gmail SMTP","vendor":"Noor Alam","versions":[{"changes":[{"at":"1.2.3.24","status":"unaffected"}],"lessThanOrEqual":"1.2.3.23","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23."}],"id":"CVE-2026-124267","lastModified":"2026-11-13T15:17:36.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.270","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-23-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"gmail-smtp","product":"Gmail SMTP","vendor":"Noor Alam","versions":[{"changes":[{"at":"1.2.3.24","status":"unaffected"}],"lessThanOrEqual":"1.2.3.23","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23."}],"id":"CVE-2026-124267","lastModified":"2026-11-13T17:17:20.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:57.590818Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.270","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/gmail-smtp/vulnerability/wordpress-gmail-smtp-plugin-1-2-3-23-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124279.json b/data/2026/CVE-2026-124279.json
new file mode 100644
index 0000000000..f706a71c0b
--- /dev/null
+++ b/data/2026/CVE-2026-124279.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"grpc_server","packageURL":"pkg:hex/grpc_server","product":"grpc_server","programFiles":["lib/grpc/server/adapters/cowboy/handler.ex","lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-grpc:grpc_server:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.GRPC.Server.Adapters.Cowboy.Handler'","'Elixir.GRPC.Server.Adapters.Cowboy'"],"packageName":"elixir-grpc/grpc","packageURL":"pkg:github/elixir-grpc/grpc","product":"grpc_server","programFiles":["grpc_server/lib/grpc/server/adapters/cowboy/handler.ex","grpc_server/lib/grpc/server/adapters/cowboy.ex"],"programRoutines":[{"name":"'Elixir.GRPC.Server.Adapters.Cowboy.Handler':info/3"},{"name":"'Elixir.GRPC.Server.Adapters.Cowboy':reading_stream/1"}],"repo":"https://github.com/elixir-grpc/grpc","vendor":"elixir-grpc","versions":[{"lessThan":"b1e771d558941b1ed4b6de8b39f6a5375543db01","status":"affected","version":"49e18c3ec6bb9afe2f712caad3dbab5c56a68a00","versionType":"git"}]}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.\n\nThe streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0."}],"id":"CVE-2026-124279","lastModified":"2026-11-13T17:17:20.593","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]},"published":"2026-11-13T17:17:20.593","references":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://cna.erlef.org/cves/CVE-2026-124279.html"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/49e18c3ec6bb9afe2f712caad3dbab5c56a68a00"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/commit/b1e771d558941b1ed4b6de8b39f6a5375543db01"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-736x-r87j-jhcm"},{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","url":"https://osv.dev/vulnerability/EEF-CVE-2026-124279"}],"sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124409.json b/data/2026/CVE-2026-124409.json
index 6109b465bc..51e099854a 100644
--- a/data/2026/CVE-2026-124409.json
+++ b/data/2026/CVE-2026-124409.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"woo-multi-currency","product":"CURCY","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.2.22","status":"unaffected"}],"lessThanOrEqual":"2.2.21","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21."}],"id":"CVE-2026-124409","lastModified":"2026-11-13T15:17:36.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.547","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"woo-multi-currency","product":"CURCY","vendor":"VillaTheme","versions":[{"changes":[{"at":"2.2.22","status":"unaffected"}],"lessThanOrEqual":"2.2.21","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.21."}],"id":"CVE-2026-124409","lastModified":"2026-11-13T17:17:20.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124409","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:02:33.694825Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.547","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/woo-multi-currency/vulnerability/wordpress-curcy-plugin-2-2-21-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124414.json b/data/2026/CVE-2026-124414.json
index 52d9ec3e68..61bb449d3b 100644
--- a/data/2026/CVE-2026-124414.json
+++ b/data/2026/CVE-2026-124414.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"videowhisper-live-streaming-integration","product":"Broadcast Live Video","vendor":"VideoWhisper.com","versions":[{"changes":[{"at":"7.3.16","status":"unaffected"}],"lessThanOrEqual":"7.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15."}],"id":"CVE-2026-124414","lastModified":"2026-11-13T15:17:37.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:36.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-15-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"videowhisper-live-streaming-integration","product":"Broadcast Live Video","vendor":"VideoWhisper.com","versions":[{"changes":[{"at":"7.3.16","status":"unaffected"}],"lessThanOrEqual":"7.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15."}],"id":"CVE-2026-124414","lastModified":"2026-11-13T17:17:20.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124414","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:44.222208Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:36.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/videowhisper-live-streaming-integration/vulnerability/wordpress-broadcast-live-video-plugin-7-3-15-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1390"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124415.json b/data/2026/CVE-2026-124415.json
index 594e0e08ad..b8cac0e376 100644
--- a/data/2026/CVE-2026-124415.json
+++ b/data/2026/CVE-2026-124415.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"alex-reservations","product":"Alex Reservations","vendor":"Alejandro","versions":[{"changes":[{"at":"2.4.9","status":"unaffected"}],"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8."}],"id":"CVE-2026-124415","lastModified":"2026-11-13T15:17:37.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:37.130","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/alex-reservations/vulnerability/wordpress-alex-reservations-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"alex-reservations","product":"Alex Reservations","vendor":"Alejandro","versions":[{"changes":[{"at":"2.4.9","status":"unaffected"}],"lessThanOrEqual":"2.4.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8."}],"id":"CVE-2026-124415","lastModified":"2026-11-13T17:17:20.997","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124415","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:55:15.857880Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:37.130","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/alex-reservations/vulnerability/wordpress-alex-reservations-plugin-2-4-8-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124666.json b/data/2026/CVE-2026-124666.json
new file mode 100644
index 0000000000..b309599f6c
--- /dev/null
+++ b/data/2026/CVE-2026-124666.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.8.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on those documented headers may therefore receive an identity that was not established by the successful authenticator.\n\n\n\nThis issue affects Apache APISIX: from 3.8.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124666","lastModified":"2026-11-13T18:17:31.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.260","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kpvbj2m069bnhod8rwyx0mdz5hkwkml"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124679.json b/data/2026/CVE-2026-124679.json
new file mode 100644
index 0000000000..e0d37fd682
--- /dev/null
+++ b/data/2026/CVE-2026-124679.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nOn routes using jwe-decrypt with strict: false and a\nforward_header distinct from the token header an unauthenticated\nclient can supply the value the upstream treats as gateway-decrypted\nplaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable.\n\n\n\nThis issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124679","lastModified":"2026-11-13T18:17:31.393","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.393","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/jmktj1o0rrxf1rdbptk0j3c4h0vdws96"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124680.json b/data/2026/CVE-2026-124680.json
new file mode 100644
index 0000000000..cd386eb5e4
--- /dev/null
+++ b/data/2026/CVE-2026-124680.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"0.9","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.\n\n\n\nAn unauthenticated client can reach upstream paths protected\nby a route-level auth plugin when a route without auth exists on the\nsame upstream and the upstream does not collapse encoded dot segments.\n\n\n\nThis issue affects Apache APISIX: from 0.9 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124680","lastModified":"2026-11-13T18:17:31.533","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.533","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/tsr691p4s58572og5f88p831vygbflvz"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124716.json b/data/2026/CVE-2026-124716.json
new file mode 100644
index 0000000000..771714af71
--- /dev/null
+++ b/data/2026/CVE-2026-124716.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"1.4.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nAn authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied.\n\n\n\nThis issue affects Apache APISIX: from 1.4.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124716","lastModified":"2026-11-13T18:17:31.670","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.670","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/5kyz1fdbgx9to7lj654wqf72yhzy2po7"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124719.json b/data/2026/CVE-2026-124719.json
new file mode 100644
index 0000000000..133aa97034
--- /dev/null
+++ b/data/2026/CVE-2026-124719.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass by spoofing vulnerability in Apache APISIX.\n\n\n\nWhen a Route's configured headers carry a caller identity and the OpenAPI document declares\nthe same header, a caller can act as another identity against the\nupstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124719","lastModified":"2026-11-13T18:17:31.803","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.803","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/k7v3vfh09mr1spk4r5k8n1gsjrhk6d8x"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124723.json b/data/2026/CVE-2026-124723.json
new file mode 100644
index 0000000000..eff3a1a44e
--- /dev/null
+++ b/data/2026/CVE-2026-124723.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"3.19.0","status":"affected","version":"3.18.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.\n\n\n\nWith match_uri_encoded_slash enabled and skip_mtls_uri_regex\nconfigured, a client without a certificate can reach an upstream\nbehind a route that requires one, limited to request paths that decode\nto an exempted URI. This issue affects Apache APISIX: from 3.18.0 through 3.19.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124723","lastModified":"2026-11-13T18:17:31.930","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:31.930","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/0r8dv4ytw5mkhrozlg7mgb9h6z5y7hpn"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124726.json b/data/2026/CVE-2026-124726.json
new file mode 100644
index 0000000000..80bfbe91ab
--- /dev/null
+++ b/data/2026/CVE-2026-124726.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:software-id/apache.org/apisix","product":"Apache APISIX","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.20.0","status":"affected","version":"3.19.0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.\n\n\n\nA caller of the MCP endpoint can invoke endpoints the OpenAPI document\nnever declared, under the declared tool's HTTP method, using the credentials the\nRoute adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.\n\n\n\nUsers are recommended to upgrade to version 3.20.0, which fixes the issue."}],"id":"CVE-2026-124726","lastModified":"2026-11-13T18:17:32.050","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}]},"published":"2026-11-13T18:17:32.050","references":[{"source":"security@apache.org","url":"https://lists.apache.org/thread/1kodokhflvr51sc1qv985om3s6mozybg"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security@apache.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-124739.json b/data/2026/CVE-2026-124739.json
index b82ef0ecf5..f0d352940e 100644
--- a/data/2026/CVE-2026-124739.json
+++ b/data/2026/CVE-2026-124739.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process."}],"id":"CVE-2026-124739","lastModified":"2026-11-11T11:17:17.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T11:17:16.983","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124739"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571613"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process."}],"id":"CVE-2026-124739","lastModified":"2026-11-13T18:17:32.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:07:54.166220Z","version":"2.0.3"}}]},"published":"2026-11-11T11:17:16.983","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124739"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571613"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124743.json b/data/2026/CVE-2026-124743.json
index 0c0c62bfcc..04cc7caf51 100644
--- a/data/2026/CVE-2026-124743.json
+++ b/data/2026/CVE-2026-124743.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution."}],"id":"CVE-2026-124743","lastModified":"2026-11-11T12:19:48.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T12:19:48.027","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124743"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571624"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. When processing filesystem metadata, the volume identification component does not properly validate header values in HFS+ filesystems. An attacker able to attach a storage device or supply a specially crafted filesystem image can trigger an application crash, resulting in a Denial of Service (DoS) and preventing device resolution."}],"id":"CVE-2026-124743","lastModified":"2026-11-13T18:17:32.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:09:44.810151Z","version":"2.0.3"}}]},"published":"2026-11-11T12:19:48.027","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124743"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571624"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124746.json b/data/2026/CVE-2026-124746.json
index 42b3a1d433..3947d78d27 100644
--- a/data/2026/CVE-2026-124746.json
+++ b/data/2026/CVE-2026-124746.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices."}],"id":"CVE-2026-124746","lastModified":"2026-11-11T15:17:19.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T15:17:19.570","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124746"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571675"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"busybox","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"busybox","product":"Red Hat Hardened Images","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices."}],"id":"CVE-2026-124746","lastModified":"2026-11-13T18:17:32.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:12:44.472407Z","version":"2.0.3"}}]},"published":"2026-11-11T15:17:19.570","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-124746"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571675"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-124970.json b/data/2026/CVE-2026-124970.json
index 0d0b4b0359..ede22a6581 100644
--- a/data/2026/CVE-2026-124970.json
+++ b/data/2026/CVE-2026-124970.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-base-booking-of-appointments-services-and-events","product":"WP BASE Booking","vendor":"WP BASE","versions":[{"changes":[{"at":"6.6.1","status":"unaffected"}],"lessThanOrEqual":"6.5.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2."}],"id":"CVE-2026-124970","lastModified":"2026-11-13T15:17:37.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:37.683","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-base-booking-of-appointments-services-and-events","product":"WP BASE Booking","vendor":"WP BASE","versions":[{"changes":[{"at":"6.6.1","status":"unaffected"}],"lessThanOrEqual":"6.5.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2."}],"id":"CVE-2026-124970","lastModified":"2026-11-13T17:17:21.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-124970","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:12.219833Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:37.683","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125332.json b/data/2026/CVE-2026-125332.json
index 26d79a8f9a..0166f2ac8b 100644
--- a/data/2026/CVE-2026-125332.json
+++ b/data/2026/CVE-2026-125332.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125332","lastModified":"2026-11-10T21:46:38.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T19:21:10.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-248"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"forge","vendor":"digitalbazaar","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createConnectionState() rejects the unsupported compression algorithm by throwing an Error that propagates from connection.process(). A malicious server or an on-path attacker can alter the unauthenticated ServerHello compression byte before the server Finished message and terminate a Node.js process when the application does not catch the exception. The affected client paths include direct forge.tls use, forge.tls.wrapSocket, and forge.http; forge.tls servers are not affected, and the issue has no confidentiality or integrity impact. This issue is fixed in version 1.4.3."}],"id":"CVE-2026-125332","lastModified":"2026-11-13T17:17:21.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125332","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:19:42.533758Z","version":"2.0.3"}}]},"published":"2026-11-10T19:21:10.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/commit/1d9816d333c23c523ef2bd8b24282c87db2654ef"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/pull/1169"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.3"},{"source":"security-advisories@github.com","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-w4xr-hqv8-ch44"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-248"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125402.json b/data/2026/CVE-2026-125402.json
index e35fc7e2ae..087c2a6122 100644
--- a/data/2026/CVE-2026-125402.json
+++ b/data/2026/CVE-2026-125402.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap."}],"id":"CVE-2026-125402","lastModified":"2026-11-12T21:07:53.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T00:17:14.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_sslwrap.c#L589-L604"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-v48w-7cvh-c7f4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-out-of-bounds-read-via-tls-sni-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Ettercap/ettercap","product":"ettercap","repo":"https://github.com/Ettercap/ettercap","vendor":"Ettercap","versions":[{"lessThanOrEqual":"0.8.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap."}],"id":"CVE-2026-125402","lastModified":"2026-11-13T17:17:21.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125402","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:12:39.401109Z","version":"2.0.3"}}]},"published":"2026-11-10T00:17:14.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/blob/v0.8.4.1/src/ec_sslwrap.c#L589-L604"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/commit/1d8badb713579419a29a494bb463a1af59707e98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/pull/1330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Ettercap/ettercap/security/advisories/GHSA-v48w-7cvh-c7f4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ettercap-through-0.8.4.1-heap-out-of-bounds-read-via-tls-sni-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125432.json b/data/2026/CVE-2026-125432.json
index 831040e78c..0d65c4d9c5 100644
--- a/data/2026/CVE-2026-125432.json
+++ b/data/2026/CVE-2026-125432.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"recaptcha-woo","product":"reCAPTCHA for WooCommerce","vendor":"RelyWP","versions":[{"changes":[{"at":"1.5.0","status":"unaffected"}],"lessThanOrEqual":"1.4.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7."}],"id":"CVE-2026-125432","lastModified":"2026-11-13T15:17:39.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:39.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/recaptcha-woo/vulnerability/wordpress-recaptcha-for-woocommerce-plugin-1-4-7-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"recaptcha-woo","product":"reCAPTCHA for WooCommerce","vendor":"RelyWP","versions":[{"changes":[{"at":"1.5.0","status":"unaffected"}],"lessThanOrEqual":"1.4.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7."}],"id":"CVE-2026-125432","lastModified":"2026-11-13T17:17:21.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125432","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:55:03.486970Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:39.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/recaptcha-woo/vulnerability/wordpress-recaptcha-for-woocommerce-plugin-1-4-7-broken-authentication-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125785.json b/data/2026/CVE-2026-125785.json
index 3ba9f342f6..0bcb0e82e1 100644
--- a/data/2026/CVE-2026-125785.json
+++ b/data/2026/CVE-2026-125785.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://crocoblock.com","defaultStatus":"unaffected","packageName":"jet-engine","product":"JetEngine","vendor":"Crocoblock","versions":[{"changes":[{"at":"3.9.1.1","status":"unaffected"}],"lessThanOrEqual":"3.9.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1."}],"id":"CVE-2026-125785","lastModified":"2026-11-12T01:17:11.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-12T01:17:11.003","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://crocoblock.com","defaultStatus":"unaffected","packageName":"jet-engine","product":"JetEngine","vendor":"Crocoblock","versions":[{"changes":[{"at":"3.9.1.1","status":"unaffected"}],"lessThanOrEqual":"3.9.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through 3.9.1."}],"id":"CVE-2026-125785","lastModified":"2026-11-13T17:17:21.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:58:07.780687Z","version":"2.0.3"}}]},"published":"2026-11-12T01:17:11.003","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-plugin-3-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125792.json b/data/2026/CVE-2026-125792.json
index a68da8bfd6..265f195d84 100644
--- a/data/2026/CVE-2026-125792.json
+++ b/data/2026/CVE-2026-125792.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"church-admin","product":"Church Admin","vendor":"Andy Moyle","versions":[{"changes":[{"at":"5.1.9","status":"unaffected"}],"lessThanOrEqual":"5.1.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8."}],"id":"CVE-2026-125792","lastModified":"2026-11-13T15:17:40.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.223","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"church-admin","product":"Church Admin","vendor":"Andy Moyle","versions":[{"changes":[{"at":"5.1.9","status":"unaffected"}],"lessThanOrEqual":"5.1.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5.1.8."}],"id":"CVE-2026-125792","lastModified":"2026-11-13T17:17:21.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125792","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:01:11.559797Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.223","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-1-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125800.json b/data/2026/CVE-2026-125800.json
index beb4012a7d..0fe695e22c 100644
--- a/data/2026/CVE-2026-125800.json
+++ b/data/2026/CVE-2026-125800.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125800","lastModified":"2026-11-13T14:17:53.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T14:17:53.567","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125800","lastModified":"2026-11-13T17:17:21.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:54.634774Z","version":"2.0.3"}}]},"published":"2026-11-13T14:17:53.567","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125802.json b/data/2026/CVE-2026-125802.json
index 03b604a978..a415459071 100644
--- a/data/2026/CVE-2026-125802.json
+++ b/data/2026/CVE-2026-125802.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125802","lastModified":"2026-11-13T15:17:40.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.520","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-125802","lastModified":"2026-11-13T17:17:21.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125802","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:23.483315Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.520","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-sensitive-data-exposure-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125807.json b/data/2026/CVE-2026-125807.json
index 4309f54e51..a28fc9b149 100644
--- a/data/2026/CVE-2026-125807.json
+++ b/data/2026/CVE-2026-125807.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125807","lastModified":"2026-11-13T15:17:40.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.660","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125807","lastModified":"2026-11-13T17:17:21.973","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:46.426054Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.660","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125808.json b/data/2026/CVE-2026-125808.json
index ec6d56b709..81e8f30c64 100644
--- a/data/2026/CVE-2026-125808.json
+++ b/data/2026/CVE-2026-125808.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125808","lastModified":"2026-11-13T15:17:40.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:40.807","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ht-mega-for-elementor","product":"HT Mega","vendor":"HTMega","versions":[{"changes":[{"at":"3.2.9","status":"unaffected"}],"lessThanOrEqual":"3.2.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8."}],"id":"CVE-2026-125808","lastModified":"2026-11-13T17:17:22.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125808","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:02:41.586919Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:40.807","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ht-mega-for-elementor/vulnerability/wordpress-ht-mega-plugin-3-2-8-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125810.json b/data/2026/CVE-2026-125810.json
index d717e37cca..c1e3524644 100644
--- a/data/2026/CVE-2026-125810.json
+++ b/data/2026/CVE-2026-125810.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125810","lastModified":"2026-11-13T15:17:41.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.093","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-7?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125810","lastModified":"2026-11-13T17:17:22.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:01:44.238778Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.093","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-broken-access-control-vulnerability-7?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125811.json b/data/2026/CVE-2026-125811.json
index 57c2103a4d..d8e9a29912 100644
--- a/data/2026/CVE-2026-125811.json
+++ b/data/2026/CVE-2026-125811.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125811","lastModified":"2026-11-13T15:17:41.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.227","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mycred","product":"myCred","vendor":"myCred","versions":[{"changes":[{"at":"4.0.3","status":"unaffected"}],"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2."}],"id":"CVE-2026-125811","lastModified":"2026-11-13T17:17:22.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:01:37.061482Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.227","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mycred/vulnerability/wordpress-mycred-plugin-4-0-2-sql-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125816.json b/data/2026/CVE-2026-125816.json
index 627163a233..db72c4e4c9 100644
--- a/data/2026/CVE-2026-125816.json
+++ b/data/2026/CVE-2026-125816.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mapsvg-lite-interactive-vector-maps","product":"MapSVG","vendor":"PT Norther Lights Production","versions":[{"changes":[{"at":"9.0.5","status":"unaffected"}],"lessThanOrEqual":"9.0.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4."}],"id":"CVE-2026-125816","lastModified":"2026-11-13T13:18:21.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.647","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-9-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"mapsvg-lite-interactive-vector-maps","product":"MapSVG","vendor":"PT Norther Lights Production","versions":[{"changes":[{"at":"9.0.5","status":"unaffected"}],"lessThanOrEqual":"9.0.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4."}],"id":"CVE-2026-125816","lastModified":"2026-11-13T17:17:23.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:58.902733Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:21.647","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-9-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125819.json b/data/2026/CVE-2026-125819.json
index fe468f439e..82b7789b90 100644
--- a/data/2026/CVE-2026-125819.json
+++ b/data/2026/CVE-2026-125819.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-125819","lastModified":"2026-11-13T15:17:41.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"advanced-gutenberg","product":"Gutenberg Blocks","vendor":"PublishPress","versions":[{"changes":[{"at":"3.7.7","status":"unaffected"}],"lessThanOrEqual":"3.7.6","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6."}],"id":"CVE-2026-125819","lastModified":"2026-11-13T17:17:23.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125819","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:03:39.726191Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.420","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/advanced-gutenberg/vulnerability/wordpress-gutenberg-blocks-plugin-3-7-6-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125824.json b/data/2026/CVE-2026-125824.json
index 16b311adb4..a08e94eff7 100644
--- a/data/2026/CVE-2026-125824.json
+++ b/data/2026/CVE-2026-125824.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-google-maps","product":"WP Go Maps","vendor":"WP Go Maps","versions":[{"changes":[{"at":"10.1.11","status":"unaffected"}],"lessThanOrEqual":"10.1.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10."}],"id":"CVE-2026-125824","lastModified":"2026-11-13T15:17:41.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.687","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-10-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"wp-google-maps","product":"WP Go Maps","vendor":"WP Go Maps","versions":[{"changes":[{"at":"10.1.11","status":"unaffected"}],"lessThanOrEqual":"10.1.10","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10."}],"id":"CVE-2026-125824","lastModified":"2026-11-13T17:17:23.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125824","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:51.066926Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.687","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/wp-google-maps/vulnerability/wordpress-wp-go-maps-plugin-10-1-10-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125825.json b/data/2026/CVE-2026-125825.json
index b627fdbee5..a5dc9899aa 100644
--- a/data/2026/CVE-2026-125825.json
+++ b/data/2026/CVE-2026-125825.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"computer-repair-shop","product":"RepairBuddy","vendor":"Webful Creations","versions":[{"changes":[{"at":"4.1237","status":"unaffected"}],"lessThanOrEqual":"4.1236","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236."}],"id":"CVE-2026-125825","lastModified":"2026-11-13T15:17:41.933","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.823","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1236-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"computer-repair-shop","product":"RepairBuddy","vendor":"Webful Creations","versions":[{"changes":[{"at":"4.1237","status":"unaffected"}],"lessThanOrEqual":"4.1236","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236."}],"id":"CVE-2026-125825","lastModified":"2026-11-13T17:17:23.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125825","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:47.482919Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.823","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1236-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125827.json b/data/2026/CVE-2026-125827.json
index 02af70067a..0d9a1f1c75 100644
--- a/data/2026/CVE-2026-125827.json
+++ b/data/2026/CVE-2026-125827.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"event-tickets","product":"Event Tickets","vendor":"Liquid Web / StellarWP","versions":[{"changes":[{"at":"5.31.1","status":"unaffected"}],"lessThanOrEqual":"5.31.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0."}],"id":"CVE-2026-125827","lastModified":"2026-11-13T15:17:42.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:41.963","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-31-0-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"event-tickets","product":"Event Tickets","vendor":"Liquid Web / StellarWP","versions":[{"changes":[{"at":"5.31.1","status":"unaffected"}],"lessThanOrEqual":"5.31.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.31.0."}],"id":"CVE-2026-125827","lastModified":"2026-11-13T17:17:23.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125827","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:01:29.042417Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:41.963","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-31-0-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125833.json b/data/2026/CVE-2026-125833.json
index 2c3d81d922..6475d1999c 100644
--- a/data/2026/CVE-2026-125833.json
+++ b/data/2026/CVE-2026-125833.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"yith-woocommerce-ajax-navigation","product":"YITH WooCommerce Ajax Product Filter","vendor":"YITH","versions":[{"changes":[{"at":"5.25.0","status":"unaffected"}],"lessThanOrEqual":"5.24.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0."}],"id":"CVE-2026-125833","lastModified":"2026-11-13T13:18:21.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.790","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-ajax-navigation/vulnerability/wordpress-yith-woocommerce-ajax-product-filter-plugin-5-24-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"yith-woocommerce-ajax-navigation","product":"YITH WooCommerce Ajax Product Filter","vendor":"YITH","versions":[{"changes":[{"at":"5.25.0","status":"unaffected"}],"lessThanOrEqual":"5.24.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0."}],"id":"CVE-2026-125833","lastModified":"2026-11-13T17:17:23.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125833","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:58:03.770972Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:21.790","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-ajax-navigation/vulnerability/wordpress-yith-woocommerce-ajax-product-filter-plugin-5-24-0-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125834.json b/data/2026/CVE-2026-125834.json
index 3c69cb7337..af63895373 100644
--- a/data/2026/CVE-2026-125834.json
+++ b/data/2026/CVE-2026-125834.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"imagify","product":"Imagify","vendor":"WP Media","versions":[{"changes":[{"at":"2.3.5","status":"unaffected"}],"lessThanOrEqual":"2.3.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4."}],"id":"CVE-2026-125834","lastModified":"2026-11-13T15:17:42.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/imagify/vulnerability/wordpress-imagify-plugin-2-3-4-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"imagify","product":"Imagify","vendor":"WP Media","versions":[{"changes":[{"at":"2.3.5","status":"unaffected"}],"lessThanOrEqual":"2.3.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4."}],"id":"CVE-2026-125834","lastModified":"2026-11-13T17:17:23.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125834","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:01:20.262708Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.280","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/imagify/vulnerability/wordpress-imagify-plugin-2-3-4-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125835.json b/data/2026/CVE-2026-125835.json
index 419c8b8de9..6d96d7f6bc 100644
--- a/data/2026/CVE-2026-125835.json
+++ b/data/2026/CVE-2026-125835.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://crocoblock.com","defaultStatus":"unaffected","packageName":"jet-tabs","product":"JetTabs","vendor":"Crocoblock","versions":[{"changes":[{"at":"2.3.5.1","status":"unaffected"}],"lessThanOrEqual":"2.3.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5."}],"id":"CVE-2026-125835","lastModified":"2026-11-13T15:17:42.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.417","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://crocoblock.com","defaultStatus":"unaffected","packageName":"jet-tabs","product":"JetTabs","vendor":"Crocoblock","versions":[{"changes":[{"at":"2.3.5.1","status":"unaffected"}],"lessThanOrEqual":"2.3.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5."}],"id":"CVE-2026-125835","lastModified":"2026-11-13T17:17:23.783","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.3,"impactScore":3.7,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:57:43.302732Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.417","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125851.json b/data/2026/CVE-2026-125851.json
index 752f88f388..8e9a7481c6 100644
--- a/data/2026/CVE-2026-125851.json
+++ b/data/2026/CVE-2026-125851.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"hotel-booking-lite","product":"Hotel Booking Lite","vendor":"themagnifico52","versions":[{"lessThanOrEqual":"2.5.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1."}],"id":"CVE-2026-125851","lastModified":"2026-11-13T15:17:42.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.697","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/theme/hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-theme-2-5-1-arbitrary-file-upload-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"hotel-booking-lite","product":"Hotel Booking Lite","vendor":"themagnifico52","versions":[{"lessThanOrEqual":"2.5.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1."}],"id":"CVE-2026-125851","lastModified":"2026-11-13T17:17:23.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125851","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:04.214993Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.697","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/theme/hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-theme-2-5-1-arbitrary-file-upload-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125852.json b/data/2026/CVE-2026-125852.json
index f060fbc8f8..79c68a39af 100644
--- a/data/2026/CVE-2026-125852.json
+++ b/data/2026/CVE-2026-125852.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"real-estate-listing-realtyna-wpl","product":"Realtyna Organic IDX plugin","vendor":"Realtyna","versions":[{"lessThanOrEqual":"5.5.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0."}],"id":"CVE-2026-125852","lastModified":"2026-11-13T15:17:42.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.840","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-4-2-arbitrary-file-deletion-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"real-estate-listing-realtyna-wpl","product":"Realtyna Organic IDX plugin","vendor":"Realtyna","versions":[{"lessThanOrEqual":"5.5.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0."}],"id":"CVE-2026-125852","lastModified":"2026-11-13T17:17:24.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:48.778974Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.840","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/real-estate-listing-realtyna-wpl/vulnerability/wordpress-realtyna-organic-idx-plugin-plugin-5-4-2-arbitrary-file-deletion-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125853.json b/data/2026/CVE-2026-125853.json
index fcff7a9be1..52472d139a 100644
--- a/data/2026/CVE-2026-125853.json
+++ b/data/2026/CVE-2026-125853.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"everest-backup","product":"Everest Backup","vendor":"Everestthemes","versions":[{"lessThanOrEqual":"2.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15."}],"id":"CVE-2026-125853","lastModified":"2026-11-13T15:17:43.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:42.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-14-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"everest-backup","product":"Everest Backup","vendor":"Everestthemes","versions":[{"lessThanOrEqual":"2.3.15","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15."}],"id":"CVE-2026-125853","lastModified":"2026-11-13T17:17:24.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:41.778917Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:42.983","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/everest-backup/vulnerability/wordpress-everest-backup-plugin-2-3-14-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125855.json b/data/2026/CVE-2026-125855.json
index d7d5191da3..607189fae4 100644
--- a/data/2026/CVE-2026-125855.json
+++ b/data/2026/CVE-2026-125855.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"elex-helpdesk-customer-support-ticket-system","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"Elextensions","versions":[{"changes":[{"at":"3.4.0","status":"unaffected"}],"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9."}],"id":"CVE-2026-125855","lastModified":"2026-11-13T15:17:43.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:43.257","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/elex-helpdesk-customer-support-ticket-system/vulnerability/wordpress-elex-wordpress-helpdesk-customer-ticketing-system-plugin-3-3-9-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"elex-helpdesk-customer-support-ticket-system","product":"ELEX WordPress HelpDesk & Customer Ticketing System","vendor":"Elextensions","versions":[{"changes":[{"at":"3.4.0","status":"unaffected"}],"lessThanOrEqual":"3.3.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9."}],"id":"CVE-2026-125855","lastModified":"2026-11-13T17:17:24.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125855","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:31.214808Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:43.257","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/elex-helpdesk-customer-support-ticket-system/vulnerability/wordpress-elex-wordpress-helpdesk-customer-ticketing-system-plugin-3-3-9-php-object-injection-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125858.json b/data/2026/CVE-2026-125858.json
index d33c85da47..c162a4b9dc 100644
--- a/data/2026/CVE-2026-125858.json
+++ b/data/2026/CVE-2026-125858.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"cleverreach-wp","product":"CleverReach® WP","vendor":"CleverReach","versions":[{"lessThanOrEqual":"1.5.26","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26."}],"id":"CVE-2026-125858","lastModified":"2026-11-13T15:17:43.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T15:17:43.550","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-26-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"cleverreach-wp","product":"CleverReach® WP","vendor":"CleverReach","versions":[{"lessThanOrEqual":"1.5.26","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26."}],"id":"CVE-2026-125858","lastModified":"2026-11-13T17:17:24.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125858","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:59:21.543049Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:43.550","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/cleverreach-wp/vulnerability/wordpress-cleverreach-wp-plugin-1-5-26-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125878.json b/data/2026/CVE-2026-125878.json
index d6ba05a9e8..16b97bea2d 100644
--- a/data/2026/CVE-2026-125878.json
+++ b/data/2026/CVE-2026-125878.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125878","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]},"published":"2026-11-10T22:18:30.380","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002ijJKAQ/cve2026125878-multiple-ognl-injection-vulnerabilities-lead-to-rce"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"N-central","vendor":"N-able","versions":[{"lessThan":"26.4.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in N-able N-central allows Resource Injection.\n\nThis issue affects N-central: before 26.4.1."}],"id":"CVE-2026-125878","lastModified":"2026-11-13T17:17:24.447","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:40:11.426932Z","version":"2.0.3"}}]},"published":"2026-11-10T22:18:30.380","references":[{"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","url":"https://me.n-able.com/s/security-advisory/aArVy0000002ijJKAQ/cve2026125878-multiple-ognl-injection-vulnerabilities-lead-to-rce"}],"sourceIdentifier":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"a5532a13-c4dd-4202-bef1-e0b8f2f8d12b","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-125926.json b/data/2026/CVE-2026-125926.json
index 8a40e6d9a0..55f091c0e2 100644
--- a/data/2026/CVE-2026-125926.json
+++ b/data/2026/CVE-2026-125926.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.34.0","status":"affected","version":"1.0.3","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0."}],"id":"CVE-2026-125926","lastModified":"2026-11-12T19:24:37.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:42.867","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"mcp-gateway-registry","vendor":"AWS","versions":[{"lessThanOrEqual":"1.34.0","status":"affected","version":"1.0.3","versionType":"custom"}]}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafted request.\n\n\n\nTo remediate this issue, users should upgrade to version 1.35.0."}],"id":"CVE-2026-125926","lastModified":"2026-11-13T18:17:32.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]},"published":"2026-11-11T21:16:42.867","references":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://aws.amazon.com/security/security-bulletins/2026-180-aws/"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/releases/tag/1.35.0"},{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","url":"https://github.com/agentic-community/mcp-gateway-registry/security/advisories/GHSA-fc39-fwh3-wv5r"}],"sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126071.json b/data/2026/CVE-2026-126071.json
index 5b0c51f209..b7196c8bcd 100644
--- a/data/2026/CVE-2026-126071.json
+++ b/data/2026/CVE-2026-126071.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":">= 8.0, < 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the storage service by calling head to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server is still reading the original ActionController::Live buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126071","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:25.263","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":">= 8.0, < 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the storage service by calling head to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and head replaces the response body while the server is still reading the original ActionController::Live buffer. That buffer is never closed, so the server thread handling the request blocks until the process restarts. Repeated failed downloads could exhaust the server's threads, possibly resulting in a DoS vulnerability. Applications are affected when they store files on a service that streams a download in several requests, such as Amazon S3, an S3-compatible service or Google Cloud Storage, and draw Active Storage's default routes. The proxy routes are drawn whether or not proxy mode is the default for the application. A file deleted while it is being served, or any other storage error partway through a download, triggers the condition. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126071","lastModified":"2026-11-13T17:17:24.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126071","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:05:22.732996Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:25.263","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-772"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126074.json b/data/2026/CVE-2026-126074.json
index 284e5f6d36..aebdd1f9ca 100644
--- a/data/2026/CVE-2026-126074.json
+++ b/data/2026/CVE-2026-126074.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, because PostgreSQL rejects the row. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126074","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:25.720","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"},{"status":"affected","version":"< 8.0.5.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, because PostgreSQL rejects the row. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126074","lastModified":"2026-11-13T17:17:24.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:08:01.643343Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:25.720","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126079.json b/data/2026/CVE-2026-126079.json
index 5a74b507ce..a6294d30bc 100644
--- a/data/2026/CVE-2026-126079.json
+++ b/data/2026/CVE-2026-126079.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126079","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:26.513","references":[{"source":"security-advisories@github.com","url":"http://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":"< 8.0.5.2"},{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, with the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."}],"id":"CVE-2026-126079","lastModified":"2026-11-13T17:17:24.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:11:45.399950Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:26.513","references":[{"source":"security-advisories@github.com","url":"http://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126083.json b/data/2026/CVE-2026-126083.json
index 4dc7660259..a71dd12fce 100644
--- a/data/2026/CVE-2026-126083.json
+++ b/data/2026/CVE-2026-126083.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs. An application is affected if it meets all of these requirements: Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, forwarded_for reads only X-Forwarded-For. Is served behind a proxy that does not remove or overwrite a client-supplied Forwarded header. Relies on request.remote_ip for access control, rate limiting, or auditing. The fix detects a spoofed Forwarded header only when the proxy also sets X-Forwarded-For. An application whose proxy passes a client-supplied Forwarded header through and sets no X-Forwarded-For remains exposed after upgrading, and should configure the proxy to remove or overwrite Forwarded, or apply the workaround below. This issue is fixed in version 8.1.4.1."}],"id":"CVE-2026-126083","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T21:19:27.133","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-348"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"rails","vendor":"rails","versions":[{"status":"affected","version":">= 8.1, < 8.1.4.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs. An application is affected if it meets all of these requirements: Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, forwarded_for reads only X-Forwarded-For. Is served behind a proxy that does not remove or overwrite a client-supplied Forwarded header. Relies on request.remote_ip for access control, rate limiting, or auditing. The fix detects a spoofed Forwarded header only when the proxy also sets X-Forwarded-For. An application whose proxy passes a client-supplied Forwarded header through and sets no X-Forwarded-For remains exposed after upgrading, and should configure the proxy to remove or overwrite Forwarded, or apply the workaround below. This issue is fixed in version 8.1.4.1."}],"id":"CVE-2026-126083","lastModified":"2026-11-13T17:17:24.893","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126083","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:22:35.722742Z","version":"2.0.3"}}]},"published":"2026-11-10T21:19:27.133","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-348"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126091.json b/data/2026/CVE-2026-126091.json
new file mode 100644
index 0000000000..2698bc76c5
--- /dev/null
+++ b/data/2026/CVE-2026-126091.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"iDentalSoft","vendor":"iDentalSoft","versions":[{"lessThan":"14.0.3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"14.0.3"}]}],"source":"9119a7d8-5eab-497f-8521-727c672e3725"}],"cveTags":[{"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3."}],"id":"CVE-2026-126091","lastModified":"2026-11-13T18:17:32.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"id":"CVE-2026-126091","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-21T19:42:40.462277Z","version":"2.0.3"}}]},"published":"2026-11-13T18:17:32.630","references":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-314-01.json"},{"source":"9119a7d8-5eab-497f-8521-727c672e3725","url":"https://www.cve.org/CVERecord?id=CVE-2026-126091"}],"sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-538"}],"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126187.json b/data/2026/CVE-2026-126187.json
index da61b1fed6..9a1b4f33f0 100644
--- a/data/2026/CVE-2026-126187.json
+++ b/data/2026/CVE-2026-126187.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"react","vendor":"react","versions":[{"status":"affected","version":">= 19.0.0, < 19.0.9"},{"status":"affected","version":">= 19.1.0, < 19.1.10"},{"status":"affected","version":">= 19.2.0, < 19.2.9"},{"status":"affected","version":">= 19.3.0, < 19.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1."}],"id":"CVE-2026-126187","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-10T23:17:20.687","references":[{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/0c9913ae87283f96e868a8f1c20a3389827632d0"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/249ac87b0dadea4ba024d1393e5cb60cf1186080"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/3d06b4005ac0cf9dec37267f26174adfe6d83611"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/611d9217df39cf7b8ac91b2e41fd00555923e904"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37842"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37843"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37844"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37845"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37846"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.1.10"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.2.9"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"react","vendor":"react","versions":[{"status":"affected","version":">= 19.0.0, < 19.0.9"},{"status":"affected","version":">= 19.1.0, < 19.1.10"},{"status":"affected","version":">= 19.2.0, < 19.2.9"},{"status":"affected","version":">= 19.3.0, < 19.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1."}],"id":"CVE-2026-126187","lastModified":"2026-11-13T17:17:25.013","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.5,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126187","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:44:19.696950Z","version":"2.0.3"}}]},"published":"2026-11-10T23:17:20.687","references":[{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/0c9913ae87283f96e868a8f1c20a3389827632d0"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/249ac87b0dadea4ba024d1393e5cb60cf1186080"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/3d06b4005ac0cf9dec37267f26174adfe6d83611"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/611d9217df39cf7b8ac91b2e41fd00555923e904"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37842"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37843"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37844"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37845"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/pull/37846"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.1.10"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.2.9"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/releases/tag/v19.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/react/react/security/advisories/GHSA-xqc2-xf4c-x3h3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126346.json b/data/2026/CVE-2026-126346.json
index a860ff07c8..5b796811f6 100644
--- a/data/2026/CVE-2026-126346.json
+++ b/data/2026/CVE-2026-126346.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"basic-ftp","vendor":"patrickjuchli","versions":[{"status":"affected","version":"< 6.2.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3."}],"id":"CVE-2026-126346","lastModified":"2026-11-12T22:19:19.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:19.607","references":[{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/commit/0495b906bdf891e68806721b07b333dba65ec88e"},{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.3"},{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-r4jh-29pc-gfqr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-755"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"basic-ftp","vendor":"patrickjuchli","versions":[{"status":"affected","version":"< 6.2.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without an exception boundary. In Client.login(), an attacker-influenced password reaches the PASS command after a server sends a 331 response, and in a resumed download an attacker-influenced remote path reaches the RETR command after a 350 response to REST. The resulting exception does not reject client.access() or downloadTo(), escapes ordinary promise error handling, and terminates the Node.js process, while the validation guard still prevents command injection. This issue is fixed in version 6.2.3."}],"id":"CVE-2026-126346","lastModified":"2026-11-13T17:17:25.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126346","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:48.090634Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:19.607","references":[{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/commit/0495b906bdf891e68806721b07b333dba65ec88e"},{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.3"},{"source":"security-advisories@github.com","url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-r4jh-29pc-gfqr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-755"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126350.json b/data/2026/CVE-2026-126350.json
index 1f6c092343..2882f1e085 100644
--- a/data/2026/CVE-2026-126350.json
+++ b/data/2026/CVE-2026-126350.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126350","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/issues/364"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.3.0, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators generate ambiguous regular expressions. When Template#match or Template#extract processes an attacker-controlled URI beginning with the operator's leading character, optional member separators allow catastrophic backtracking and denial of service on MRI Ruby before 3.2 and JRuby. Addressable 2.9.0 incompletely remediated the earlier template issue because its tests did not reach these operator-prefixed paths. URI parsing and Template#expand are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126350","lastModified":"2026-11-13T17:17:25.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:50.373815Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:20.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/26d1e9e8409a861571f9d0029022b6e9b9158b5e"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/issues/364"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-j82w-28jv-3pmj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126354.json b/data/2026/CVE-2026-126354.json
index 7d4952a557..8ad6779fc1 100644
--- a/data/2026/CVE-2026-126354.json
+++ b/data/2026/CVE-2026-126354.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.2.5, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126354","lastModified":"2026-11-13T16:08:55.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T22:19:20.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"addressable","vendor":"sporkmonger","versions":[{"status":"affected","version":">= 2.2.5, < 2.9.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1."}],"id":"CVE-2026-126354","lastModified":"2026-11-13T17:17:25.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126354","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:52.994631Z","version":"2.0.3"}}]},"published":"2026-11-12T22:19:20.810","references":[{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/commit/25c7c412a2f7e06c3cac92872e831f6d053703c5"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1"},{"source":"security-advisories@github.com","url":"https://github.com/sporkmonger/addressable/security/advisories/GHSA-8gmh-2hhj-2hv9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126362.json b/data/2026/CVE-2026-126362.json
index 97cff2f694..f136a9d2bb 100644
--- a/data/2026/CVE-2026-126362.json
+++ b/data/2026/CVE-2026-126362.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"astro","vendor":"withastro","versions":[{"status":"affected","version":">= 5.7.3, < 9.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2."}],"id":"CVE-2026-126362","lastModified":"2026-11-13T00:20:11.763","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:11.763","references":[{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/commit/5e476365378e41aa2745d003b2383d02008d7b44"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/releases/tag/@astrojs/svelte@9.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/security/advisories/GHSA-f4j9-crrj-867q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"astro","vendor":"withastro","versions":[{"status":"affected","version":">= 5.7.3, < 9.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2."}],"id":"CVE-2026-126362","lastModified":"2026-11-13T17:17:25.507","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:56.006808Z","version":"2.0.3"}}]},"published":"2026-11-13T00:20:11.763","references":[{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/commit/5e476365378e41aa2745d003b2383d02008d7b44"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/releases/tag/@astrojs/svelte@9.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/withastro/astro/security/advisories/GHSA-f4j9-crrj-867q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126415.json b/data/2026/CVE-2026-126415.json
index 1d687e981c..dae17db626 100644
--- a/data/2026/CVE-2026-126415.json
+++ b/data/2026/CVE-2026-126415.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table."}],"id":"CVE-2026-126415","lastModified":"2026-11-13T16:18:25.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126415","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:19.342747Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:46.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table."}],"id":"CVE-2026-126415","lastModified":"2026-11-13T16:18:25.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126415","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:19.342747Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:46.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q4jf-6gcg-m3jx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-patientvalidation-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126416.json b/data/2026/CVE-2026-126416.json
index da795e3728..e91354b9fc 100644
--- a/data/2026/CVE-2026-126416.json
+++ b/data/2026/CVE-2026-126416.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state."}],"id":"CVE-2026-126416","lastModified":"2026-11-13T10:17:47.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cxjf-fmpw-qc34"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-patient-tracker-status-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state."}],"id":"CVE-2026-126416","lastModified":"2026-11-13T10:17:47.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cxjf-fmpw-qc34"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-patient-tracker-status-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-285"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126417.json b/data/2026/CVE-2026-126417.json
index e0a9ec1b4c..5ffe971d02 100644
--- a/data/2026/CVE-2026-126417.json
+++ b/data/2026/CVE-2026-126417.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document."}],"id":"CVE-2026-126417","lastModified":"2026-11-13T10:17:47.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-9rw5-h7xf-57mc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-get-claim-file-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document."}],"id":"CVE-2026-126417","lastModified":"2026-11-13T10:17:47.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-9rw5-h7xf-57mc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-get-claim-file-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126418.json b/data/2026/CVE-2026-126418.json
index dfa557c757..d6caeeeb96 100644
--- a/data/2026/CVE-2026-126418.json
+++ b/data/2026/CVE-2026-126418.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user."}],"id":"CVE-2026-126418","lastModified":"2026-11-13T10:17:47.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-in-sl-eob-invoice-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user."}],"id":"CVE-2026-126418","lastModified":"2026-11-13T10:17:47.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-v7qh-q4xq-28v3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-in-sl-eob-invoice-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126419.json b/data/2026/CVE-2026-126419.json
index c2f4eea8d7..4899a273a6 100644
--- a/data/2026/CVE-2026-126419.json
+++ b/data/2026/CVE-2026-126419.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing."}],"id":"CVE-2026-126419","lastModified":"2026-11-13T16:18:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126419","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:16.858711Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:47.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing."}],"id":"CVE-2026-126419","lastModified":"2026-11-13T16:18:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126419","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:16.858711Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:47.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6x2w-9gwv-mc7v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-e-sign-form-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126420.json b/data/2026/CVE-2026-126420.json
index 7030d53797..f55f67d9e6 100644
--- a/data/2026/CVE-2026-126420.json
+++ b/data/2026/CVE-2026-126420.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records."}],"id":"CVE-2026-126420","lastModified":"2026-11-13T10:17:47.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-ppg9-2f9f-chc4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-faxsms-utility-php-patient-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records."}],"id":"CVE-2026-126420","lastModified":"2026-11-13T10:17:47.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:47.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-ppg9-2f9f-chc4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-faxsms-utility-php-patient-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126421.json b/data/2026/CVE-2026-126421.json
index 352851621a..079d75074a 100644
--- a/data/2026/CVE-2026-126421.json
+++ b/data/2026/CVE-2026-126421.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable."}],"id":"CVE-2026-126421","lastModified":"2026-11-13T10:17:48.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3j3r-w7q7-h9fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-labs-ajax-php-label-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable."}],"id":"CVE-2026-126421","lastModified":"2026-11-13T10:17:48.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3j3r-w7q7-h9fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-labs-ajax-php-label-count"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126422.json b/data/2026/CVE-2026-126422.json
index aca038f7bd..fed5d8cd51 100644
--- a/data/2026/CVE-2026-126422.json
+++ b/data/2026/CVE-2026-126422.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record \"None known\" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations."}],"id":"CVE-2026-126422","lastModified":"2026-11-13T10:17:48.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.197","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-924r-c6jp-67px"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-lists-touch-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record \"None known\" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations."}],"id":"CVE-2026-126422","lastModified":"2026-11-13T10:17:48.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.197","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-924r-c6jp-67px"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-lists-touch-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126423.json b/data/2026/CVE-2026-126423.json
index 9c24fca17b..be98fc2209 100644
--- a/data/2026/CVE-2026-126423.json
+++ b/data/2026/CVE-2026-126423.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable."}],"id":"CVE-2026-126423","lastModified":"2026-11-13T16:18:27.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:13.820205Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:48.363","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable."}],"id":"CVE-2026-126423","lastModified":"2026-11-13T16:18:27.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:13.820205Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:48.363","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pqmf-m4h6-wjh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-denial-of-service-via-zip-upload-decompression"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126424.json b/data/2026/CVE-2026-126424.json
index 1ee49d0a77..32087fd0ff 100644
--- a/data/2026/CVE-2026-126424.json
+++ b/data/2026/CVE-2026-126424.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions."}],"id":"CVE-2026-126424","lastModified":"2026-11-13T10:17:48.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.523","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qv97-cvw6-8j53"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-descriptions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions."}],"id":"CVE-2026-126424","lastModified":"2026-11-13T10:17:48.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.523","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qv97-cvw6-8j53"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-billing-code-descriptions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126425.json b/data/2026/CVE-2026-126425.json
index 082063eef9..a58674d54f 100644
--- a/data/2026/CVE-2026-126425.json
+++ b/data/2026/CVE-2026-126425.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges."}],"id":"CVE-2026-126425","lastModified":"2026-11-13T10:17:48.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.3,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.683","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fq58-jp5g-x44q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-sql-injection-via-history-layout-field-identifiers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges."}],"id":"CVE-2026-126425","lastModified":"2026-11-13T10:17:48.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.3,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.683","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fq58-jp5g-x44q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-sql-injection-via-history-layout-field-identifiers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126426.json b/data/2026/CVE-2026-126426.json
index 8b30610f86..09d3fafa91 100644
--- a/data/2026/CVE-2026-126426.json
+++ b/data/2026/CVE-2026-126426.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"5.0.2","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password."}],"id":"CVE-2026-126426","lastModified":"2026-11-13T10:17:48.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/e0dee295497bba763151913bde563a826c739cd7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-5.0.2-before-8.5.0-missing-re-authentication-for-mfa-factor-deletion-and-u2f-registration"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"5.0.2","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password."}],"id":"CVE-2026-126426","lastModified":"2026-11-13T10:17:48.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:48.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/e0dee295497bba763151913bde563a826c739cd7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rcrp-xxch-gxfh"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-5.0.2-before-8.5.0-missing-re-authentication-for-mfa-factor-deletion-and-u2f-registration"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126427.json b/data/2026/CVE-2026-126427.json
index 48d2800275..6b3e20823c 100644
--- a/data/2026/CVE-2026-126427.json
+++ b/data/2026/CVE-2026-126427.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds."}],"id":"CVE-2026-126427","lastModified":"2026-11-13T16:18:28.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.4,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:10.870766Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds."}],"id":"CVE-2026-126427","lastModified":"2026-11-13T16:18:28.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":0.4,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"PHYSICAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126427","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:10.870766Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.023","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fc6f-f47r-j9x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idle-session-timeout-bypass-via-eye-exam-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126428.json b/data/2026/CVE-2026-126428.json
index 49039a6f53..97c4187769 100644
--- a/data/2026/CVE-2026-126428.json
+++ b/data/2026/CVE-2026-126428.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user."}],"id":"CVE-2026-126428","lastModified":"2026-11-13T10:17:49.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.193","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r6wm-8m2j-c3q9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-rce-via-stored-era-upload-and-background-services"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user."}],"id":"CVE-2026-126428","lastModified":"2026-11-13T10:17:49.317","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.193","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r6wm-8m2j-c3q9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-rce-via-stored-era-upload-and-background-services"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126429.json b/data/2026/CVE-2026-126429.json
index e996e6a8b9..c817fba858 100644
--- a/data/2026/CVE-2026-126429.json
+++ b/data/2026/CVE-2026-126429.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys."}],"id":"CVE-2026-126429","lastModified":"2026-11-13T10:17:49.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-h4xc-pqg3-8459"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-local-file-disclosure-via-doc-lib-php-pdf-renderer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys."}],"id":"CVE-2026-126429","lastModified":"2026-11-13T10:17:49.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-h4xc-pqg3-8459"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-local-file-disclosure-via-doc-lib-php-pdf-renderer"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126430.json b/data/2026/CVE-2026-126430.json
index 117cea0d01..8f4835b934 100644
--- a/data/2026/CVE-2026-126430.json
+++ b/data/2026/CVE-2026-126430.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts."}],"id":"CVE-2026-126430","lastModified":"2026-11-13T10:17:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-field-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts."}],"id":"CVE-2026-126430","lastModified":"2026-11-13T10:17:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-field-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126431.json b/data/2026/CVE-2026-126431.json
index f5d988a9e5..5034c10a1d 100644
--- a/data/2026/CVE-2026-126431.json
+++ b/data/2026/CVE-2026-126431.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records."}],"id":"CVE-2026-126431","lastModified":"2026-11-13T16:18:29.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:21.059965Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records."}],"id":"CVE-2026-126431","lastModified":"2026-11-13T16:18:29.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126431","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:21.059965Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:49.700","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8rgh-38j4-6pxf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-carecoordination-ccda-mapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126432.json b/data/2026/CVE-2026-126432.json
index 9161f531f8..ffb12f9cc9 100644
--- a/data/2026/CVE-2026-126432.json
+++ b/data/2026/CVE-2026-126432.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted."}],"id":"CVE-2026-126432","lastModified":"2026-11-13T10:17:49.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.867","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3xjm-656g-cfj5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-lab-order-transmission-via-list-reports-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted."}],"id":"CVE-2026-126432","lastModified":"2026-11-13T10:17:49.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:49.867","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3xjm-656g-cfj5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-lab-order-transmission-via-list-reports-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126433.json b/data/2026/CVE-2026-126433.json
index fd1362f7fe..8a0d0a2a02 100644
--- a/data/2026/CVE-2026-126433.json
+++ b/data/2026/CVE-2026-126433.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory."}],"id":"CVE-2026-126433","lastModified":"2026-11-13T10:17:50.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hp8p-h8g8-xmg3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-dispense-drug-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory."}],"id":"CVE-2026-126433","lastModified":"2026-11-13T10:17:50.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hp8p-h8g8-xmg3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-dispense-drug-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126434.json b/data/2026/CVE-2026-126434.json
index cd06b1e7fa..f9648393b6 100644
--- a/data/2026/CVE-2026-126434.json
+++ b/data/2026/CVE-2026-126434.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status."}],"id":"CVE-2026-126434","lastModified":"2026-11-13T10:17:50.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q5c6-96vf-rx9v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-procedure-order-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status."}],"id":"CVE-2026-126434","lastModified":"2026-11-13T10:17:50.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q5c6-96vf-rx9v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-procedure-order-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126435.json b/data/2026/CVE-2026-126435.json
index a834e0c3e0..a10c1b03b8 100644
--- a/data/2026/CVE-2026-126435.json
+++ b/data/2026/CVE-2026-126435.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures."}],"id":"CVE-2026-126435","lastModified":"2026-11-13T16:18:30.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:08.335864Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures."}],"id":"CVE-2026-126435","lastModified":"2026-11-13T16:18:30.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:08.335864Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xmjf-8fc9-hh38"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-via-order-manifest-php-lab-order-flags"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126436.json b/data/2026/CVE-2026-126436.json
index 9ae346aeb5..0dd86d54eb 100644
--- a/data/2026/CVE-2026-126436.json
+++ b/data/2026/CVE-2026-126436.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions."}],"id":"CVE-2026-126436","lastModified":"2026-11-13T10:17:50.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.510","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qjj7-c4m9-6f92"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-oauth2-grant-type-enforcement-bypass-via-token-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions."}],"id":"CVE-2026-126436","lastModified":"2026-11-13T10:17:50.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.510","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qjj7-c4m9-6f92"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-oauth2-grant-type-enforcement-bypass-via-token-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126437.json b/data/2026/CVE-2026-126437.json
index 790d3df46a..25e0f1d885 100644
--- a/data/2026/CVE-2026-126437.json
+++ b/data/2026/CVE-2026-126437.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions."}],"id":"CVE-2026-126437","lastModified":"2026-11-13T10:17:50.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.660","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vc2h-x8xf-8jcv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-portal-lib-download-template-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions."}],"id":"CVE-2026-126437","lastModified":"2026-11-13T10:17:50.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.660","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vc2h-x8xf-8jcv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-portal-lib-download-template-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126438.json b/data/2026/CVE-2026-126438.json
index 206233e70f..1dd6cdba79 100644
--- a/data/2026/CVE-2026-126438.json
+++ b/data/2026/CVE-2026-126438.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad."}],"id":"CVE-2026-126438","lastModified":"2026-11-13T10:17:50.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xqq3-59h5-xhmr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-clinical-rule-editor-patient-data-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad."}],"id":"CVE-2026-126438","lastModified":"2026-11-13T10:17:50.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:50.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xqq3-59h5-xhmr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-improper-authorization-in-clinical-rule-editor-patient-data-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126439.json b/data/2026/CVE-2026-126439.json
index 0edf9210ac..bc2accd78f 100644
--- a/data/2026/CVE-2026-126439.json
+++ b/data/2026/CVE-2026-126439.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers."}],"id":"CVE-2026-126439","lastModified":"2026-11-13T16:18:31.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:05.813167Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7cfr-7h7r-f2x9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-c-cda-gateway-ccda-gateway-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers."}],"id":"CVE-2026-126439","lastModified":"2026-11-13T16:18:31.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126439","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:05.813167Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:50.987","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7cfr-7h7r-f2x9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-authorization-bypass-via-c-cda-gateway-ccda-gateway-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126440.json b/data/2026/CVE-2026-126440.json
index 698f7afb33..470d6474b1 100644
--- a/data/2026/CVE-2026-126440.json
+++ b/data/2026/CVE-2026-126440.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval."}],"id":"CVE-2026-126440","lastModified":"2026-11-13T10:17:51.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.150","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mmpv-ph5x-x4m3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-document-acl-bypass-via-care-coordination-import"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval."}],"id":"CVE-2026-126440","lastModified":"2026-11-13T10:17:51.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.150","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mmpv-ph5x-x4m3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-document-acl-bypass-via-care-coordination-import"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126441.json b/data/2026/CVE-2026-126441.json
index 66cd714d28..c5a43b6705 100644
--- a/data/2026/CVE-2026-126441.json
+++ b/data/2026/CVE-2026-126441.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions."}],"id":"CVE-2026-126441","lastModified":"2026-11-13T10:17:51.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.317","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gf9c-4hh8-gh49"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-via-camos-rx-print-php-prescription-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions."}],"id":"CVE-2026-126441","lastModified":"2026-11-13T10:17:51.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.317","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gf9c-4hh8-gh49"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-via-camos-rx-print-php-prescription-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126442.json b/data/2026/CVE-2026-126442.json
index 76089130ff..2e6c209a1f 100644
--- a/data/2026/CVE-2026-126442.json
+++ b/data/2026/CVE-2026-126442.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out."}],"id":"CVE-2026-126442","lastModified":"2026-11-13T10:17:51.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.480","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-83hq-c876-fcwf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-create-portallogin-php-portal-takeover"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and post replacement credentials to take over portal accounts, read PHI, and lock patients out."}],"id":"CVE-2026-126442","lastModified":"2026-11-13T10:17:51.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.480","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-83hq-c876-fcwf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-create-portallogin-php-portal-takeover"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126443.json b/data/2026/CVE-2026-126443.json
index c8ff8a58bf..8a77b7b496 100644
--- a/data/2026/CVE-2026-126443.json
+++ b/data/2026/CVE-2026-126443.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice."}],"id":"CVE-2026-126443","lastModified":"2026-11-13T16:18:32.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:00.760097Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:51.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-79g8-hm7q-xrh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-dynamic-finder-ajax-php-patient-finder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice."}],"id":"CVE-2026-126443","lastModified":"2026-11-13T16:18:32.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:30:00.760097Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:51.650","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-79g8-hm7q-xrh4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-dynamic-finder-ajax-php-patient-finder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126444.json b/data/2026/CVE-2026-126444.json
index aa8810860c..a447df355a 100644
--- a/data/2026/CVE-2026-126444.json
+++ b/data/2026/CVE-2026-126444.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes."}],"id":"CVE-2026-126444","lastModified":"2026-11-13T10:17:51.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.830","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mcr3-5rq6-9vvj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ensora-erx-via-erx-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients' demographic, medication, and allergy data in the vendor XML and trigger eRx synchronization state changes."}],"id":"CVE-2026-126444","lastModified":"2026-11-13T10:17:51.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:51.830","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mcr3-5rq6-9vvj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ensora-erx-via-erx-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126445.json b/data/2026/CVE-2026-126445.json
index 07604535aa..2c9045d47c 100644
--- a/data/2026/CVE-2026-126445.json
+++ b/data/2026/CVE-2026-126445.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history."}],"id":"CVE-2026-126445","lastModified":"2026-11-13T10:17:52.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.003","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-2984-qxv9-6r62"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-flow-board-tracker-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to falsify check-in status, rooms, drug-screen completion, and tracker history."}],"id":"CVE-2026-126445","lastModified":"2026-11-13T10:17:52.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.003","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-2984-qxv9-6r62"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-flow-board-tracker-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126446.json b/data/2026/CVE-2026-126446.json
index 30c5c17e4c..93bdc77d17 100644
--- a/data/2026/CVE-2026-126446.json
+++ b/data/2026/CVE-2026-126446.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes."}],"id":"CVE-2026-126446","lastModified":"2026-11-13T10:17:52.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.170","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pf2f-4xph-fhjx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-destroyed-drugs-report-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date range to obtain drug names, NDC, lots, quantities, destruction methods, witnesses, and notes."}],"id":"CVE-2026-126446","lastModified":"2026-11-13T10:17:52.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.170","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pf2f-4xph-fhjx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-destroyed-drugs-report-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126447.json b/data/2026/CVE-2026-126447.json
index 2449fe1039..58d8e9e4c4 100644
--- a/data/2026/CVE-2026-126447.json
+++ b/data/2026/CVE-2026-126447.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications."}],"id":"CVE-2026-126447","lastModified":"2026-11-13T16:18:33.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:56.193811Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.333","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic's phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications."}],"id":"CVE-2026-126447","lastModified":"2026-11-13T16:18:33.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:56.193811Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.333","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vf9m-wg38-vcc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-trusted-messages-ajax-php-direct-messaging"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126448.json b/data/2026/CVE-2026-126448.json
index 4b7a8fa084..0ef918309e 100644
--- a/data/2026/CVE-2026-126448.json
+++ b/data/2026/CVE-2026-126448.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments."}],"id":"CVE-2026-126448","lastModified":"2026-11-13T10:17:52.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-m4cw-vx96-p6fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-nation-notes-configuration-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php or add_context.php, which lack ACL and CSRF checks, to tamper with clinical-note templates and assignments."}],"id":"CVE-2026-126448","lastModified":"2026-11-13T10:17:52.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-m4cw-vx96-p6fj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-nation-notes-configuration-handlers"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126449.json b/data/2026/CVE-2026-126449.json
index 4c16f18bf3..1532f81f6a 100644
--- a/data/2026/CVE-2026-126449.json
+++ b/data/2026/CVE-2026-126449.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor."}],"id":"CVE-2026-126449","lastModified":"2026-11-13T10:17:52.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.667","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xp7w-8fx3-642x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-immunizations-php-diagnosis-full-php-billing-process-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billing_process.php that lets low-privileged users bypass ACL checks. Authenticated Front Office users can reuse their session CSRF token to add or delete immunizations, write encounter billing codes, and invoke the billing processor."}],"id":"CVE-2026-126449","lastModified":"2026-11-13T10:17:52.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.667","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-xp7w-8fx3-642x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-immunizations-php-diagnosis-full-php-billing-process-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126450.json b/data/2026/CVE-2026-126450.json
index 66cdb4dc2c..6680884711 100644
--- a/data/2026/CVE-2026-126450.json
+++ b/data/2026/CVE-2026-126450.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions."}],"id":"CVE-2026-126450","lastModified":"2026-11-13T10:17:52.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.833","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-w2f7-289j-92pp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-patient-external-id-in-prescriptions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by placing payloads in the patient External ID field. The payload executes when other users open the patient's prescriptions via View Printable Version (HTML), running script in their browser sessions."}],"id":"CVE-2026-126450","lastModified":"2026-11-13T10:17:52.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:52.833","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-w2f7-289j-92pp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-patient-external-id-in-prescriptions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-80"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126451.json b/data/2026/CVE-2026-126451.json
index 73ac4817e1..5ba584758d 100644
--- a/data/2026/CVE-2026-126451.json
+++ b/data/2026/CVE-2026-126451.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints."}],"id":"CVE-2026-126451","lastModified":"2026-11-13T16:18:34.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:18.789189Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hfpq-j3fj-cpmv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-document-template-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints."}],"id":"CVE-2026-126451","lastModified":"2026-11-13T16:18:34.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:18.789189Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:52.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hfpq-j3fj-cpmv"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-document-template-rendering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126452.json b/data/2026/CVE-2026-126452.json
index 3673b2c39e..d574bcc297 100644
--- a/data/2026/CVE-2026-126452.json
+++ b/data/2026/CVE-2026-126452.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records."}],"id":"CVE-2026-126452","lastModified":"2026-11-13T10:17:53.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-diagnosis-full-php-billing-operations"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records."}],"id":"CVE-2026-126452","lastModified":"2026-11-13T10:17:53.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r65f-fxf6-4fwr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-diagnosis-full-php-billing-operations"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126453.json b/data/2026/CVE-2026-126453.json
index 826842c762..a3012c380a 100644
--- a/data/2026/CVE-2026-126453.json
+++ b/data/2026/CVE-2026-126453.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely."}],"id":"CVE-2026-126453","lastModified":"2026-11-13T10:17:53.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.347","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fp98-qfh5-xjhc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-inverted-document-expiration-check-exposes-phi-via-fhir-binary"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk export NDJSON files and $docref CCDs indefinitely."}],"id":"CVE-2026-126453","lastModified":"2026-11-13T10:17:53.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.347","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-fp98-qfh5-xjhc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-inverted-document-expiration-check-exposes-phi-via-fhir-binary"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126454.json b/data/2026/CVE-2026-126454.json
index 64ac568c59..106dc5cdc2 100644
--- a/data/2026/CVE-2026-126454.json
+++ b/data/2026/CVE-2026-126454.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication."}],"id":"CVE-2026-126454","lastModified":"2026-11-13T10:17:53.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rp7c-25mm-8g74"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-totp-brute-force-via-main-screen-php-and-oauth2"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass two-factor authentication."}],"id":"CVE-2026-126454","lastModified":"2026-11-13T10:17:53.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.507","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rp7c-25mm-8g74"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-totp-brute-force-via-main-screen-php-and-oauth2"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126455.json b/data/2026/CVE-2026-126455.json
index a88e0e9e4f..94a605aecf 100644
--- a/data/2026/CVE-2026-126455.json
+++ b/data/2026/CVE-2026-126455.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records."}],"id":"CVE-2026-126455","lastModified":"2026-11-13T16:18:35.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:16.538512Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:53.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal identities, and forge approved clinical records."}],"id":"CVE-2026-126455","lastModified":"2026-11-13T16:18:35.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:16.538512Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:53.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/commit/71da6605dc3bcc1405ee9a65cb9f579ecbc8a1c6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vr7f-7c3w-49g7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-privilege-escalation-via-missing-authorization-and-sql-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126456.json b/data/2026/CVE-2026-126456.json
index 326bb0c153..5963d0c635 100644
--- a/data/2026/CVE-2026-126456.json
+++ b/data/2026/CVE-2026-126456.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers."}],"id":"CVE-2026-126456","lastModified":"2026-11-13T10:17:53.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.833","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-ff55-qvf9-2fgm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-fee-sheet-notecodes-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers."}],"id":"CVE-2026-126456","lastModified":"2026-11-13T10:17:53.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.833","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-ff55-qvf9-2fgm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-fee-sheet-notecodes-field"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126457.json b/data/2026/CVE-2026-126457.json
index 7b153670ab..e22d698c19 100644
--- a/data/2026/CVE-2026-126457.json
+++ b/data/2026/CVE-2026-126457.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules."}],"id":"CVE-2026-126457","lastModified":"2026-11-13T10:17:54.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.997","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-32cq-gh7x-jpqw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-installercontroller-module-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules."}],"id":"CVE-2026-126457","lastModified":"2026-11-13T10:17:54.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:53.997","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-32cq-gh7x-jpqw"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-installercontroller-module-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126458.json b/data/2026/CVE-2026-126458.json
index 2e9689e35b..fb4b33f351 100644
--- a/data/2026/CVE-2026-126458.json
+++ b/data/2026/CVE-2026-126458.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review."}],"id":"CVE-2026-126458","lastModified":"2026-11-13T10:17:54.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-j467-662w-jwvj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-authorizations-full-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review."}],"id":"CVE-2026-126458","lastModified":"2026-11-13T10:17:54.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-j467-662w-jwvj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-authorizations-full-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126460.json b/data/2026/CVE-2026-126460.json
index b9c50acf9c..82b1be5dd4 100644
--- a/data/2026/CVE-2026-126460.json
+++ b/data/2026/CVE-2026-126460.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information."}],"id":"CVE-2026-126460","lastModified":"2026-11-13T16:18:36.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:53.686802Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:54.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information."}],"id":"CVE-2026-126460","lastModified":"2026-11-13T16:18:36.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:53.686802Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:54.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hqjp-rcv8-7p9c"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-persistent-sql-injection-via-era-file-reprocessing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126461.json b/data/2026/CVE-2026-126461.json
index 35080b26eb..941187ce25 100644
--- a/data/2026/CVE-2026-126461.json
+++ b/data/2026/CVE-2026-126461.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI."}],"id":"CVE-2026-126461","lastModified":"2026-11-13T10:17:54.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-prmv-3m3j-9v7j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-user-settings-php-global-override"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI."}],"id":"CVE-2026-126461","lastModified":"2026-11-13T10:17:54.647","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.520","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-prmv-3m3j-9v7j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-user-settings-php-global-override"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126462.json b/data/2026/CVE-2026-126462.json
index 525c2cac79..b61ea08648 100644
--- a/data/2026/CVE-2026-126462.json
+++ b/data/2026/CVE-2026-126462.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data."}],"id":"CVE-2026-126462","lastModified":"2026-11-13T10:17:54.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.690","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rgv4-6mf9-hxwx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-next-visit-orders"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data."}],"id":"CVE-2026-126462","lastModified":"2026-11-13T10:17:54.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.690","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-rgv4-6mf9-hxwx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-next-visit-orders"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126463.json b/data/2026/CVE-2026-126463.json
index 797710cda6..a77f3bf556 100644
--- a/data/2026/CVE-2026-126463.json
+++ b/data/2026/CVE-2026-126463.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields."}],"id":"CVE-2026-126463","lastModified":"2026-11-13T10:17:55.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g7m7-pc2p-7h7q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-billing-parser-reports-zend-modules"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields."}],"id":"CVE-2026-126463","lastModified":"2026-11-13T10:17:55.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:54.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g7m7-pc2p-7h7q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-billing-parser-reports-zend-modules"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126464.json b/data/2026/CVE-2026-126464.json
index 324ea30045..6d0c43a718 100644
--- a/data/2026/CVE-2026-126464.json
+++ b/data/2026/CVE-2026-126464.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints."}],"id":"CVE-2026-126464","lastModified":"2026-11-13T16:18:37.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:50.299608Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.077","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints."}],"id":"CVE-2026-126464","lastModified":"2026-11-13T16:18:37.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:50.299608Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.077","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc8m-q5xj-j34x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-ssrf-via-patient-portal-pdf-generation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126465.json b/data/2026/CVE-2026-126465.json
index 01d689b688..59a359c1a1 100644
--- a/data/2026/CVE-2026-126465.json
+++ b/data/2026/CVE-2026-126465.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens."}],"id":"CVE-2026-126465","lastModified":"2026-11-13T10:17:55.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.247","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsiteactivityview-bitwiseand-criteria"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens."}],"id":"CVE-2026-126465","lastModified":"2026-11-13T10:17:55.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.247","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsiteactivityview-bitwiseand-criteria"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126466.json b/data/2026/CVE-2026-126466.json
index 0c6fc4edbe..963fdfc8f5 100644
--- a/data/2026/CVE-2026-126466.json
+++ b/data/2026/CVE-2026-126466.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs."}],"id":"CVE-2026-126466","lastModified":"2026-11-13T10:17:55.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cwpg-qv34-gx8x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-create-and-search-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs."}],"id":"CVE-2026-126466","lastModified":"2026-11-13T10:17:55.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.417","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cwpg-qv34-gx8x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-patient-create-and-search-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126467.json b/data/2026/CVE-2026-126467.json
index fc6fbf7ea0..b4d63bdb68 100644
--- a/data/2026/CVE-2026-126467.json
+++ b/data/2026/CVE-2026-126467.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter."}],"id":"CVE-2026-126467","lastModified":"2026-11-13T10:17:55.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qv6p-57wj-w55p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-mass-assignment-via-observation-form-save-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter."}],"id":"CVE-2026-126467","lastModified":"2026-11-13T10:17:55.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-qv6p-57wj-w55p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-mass-assignment-via-observation-form-save-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-915"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126468.json b/data/2026/CVE-2026-126468.json
index 1355240738..07fa2709b2 100644
--- a/data/2026/CVE-2026-126468.json
+++ b/data/2026/CVE-2026-126468.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing."}],"id":"CVE-2026-126468","lastModified":"2026-11-13T16:18:39.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:14.126294Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing."}],"id":"CVE-2026-126468","lastModified":"2026-11-13T16:18:39.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:14.126294Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:55.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6h9j-m5w9-8938"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-on-reports-and-reminder-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126469.json b/data/2026/CVE-2026-126469.json
index 17b15eb9e4..7e095c5183 100644
--- a/data/2026/CVE-2026-126469.json
+++ b/data/2026/CVE-2026-126469.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records."}],"id":"CVE-2026-126469","lastModified":"2026-11-13T10:17:56.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.920","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3h5w-672p-v4m9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-custom-export-and-chart-tracker-scripts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records."}],"id":"CVE-2026-126469","lastModified":"2026-11-13T10:17:56.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:55.920","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3h5w-672p-v4m9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-custom-export-and-chart-tracker-scripts"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126470.json b/data/2026/CVE-2026-126470.json
index 6157078761..124d522937 100644
--- a/data/2026/CVE-2026-126470.json
+++ b/data/2026/CVE-2026-126470.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records."}],"id":"CVE-2026-126470","lastModified":"2026-11-13T10:17:56.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3vxh-7hh5-vhhm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-in-carecoordination-ccda-ccr-qrda-document-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records."}],"id":"CVE-2026-126470","lastModified":"2026-11-13T10:17:56.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-3vxh-7hh5-vhhm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-idor-in-carecoordination-ccda-ccr-qrda-document-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126471.json b/data/2026/CVE-2026-126471.json
index d757580a27..0149e4b64e 100644
--- a/data/2026/CVE-2026-126471.json
+++ b/data/2026/CVE-2026-126471.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure."}],"id":"CVE-2026-126471","lastModified":"2026-11-13T10:17:56.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.253","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-h9rv-wxcp-x85f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-print-referral-php-and-trend-form-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure."}],"id":"CVE-2026-126471","lastModified":"2026-11-13T10:17:56.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.253","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-h9rv-wxcp-x85f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-print-referral-php-and-trend-form-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126472.json b/data/2026/CVE-2026-126472.json
index 87932f5361..a5f20de57a 100644
--- a/data/2026/CVE-2026-126472.json
+++ b/data/2026/CVE-2026-126472.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations."}],"id":"CVE-2026-126472","lastModified":"2026-11-13T16:18:40.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:11.855427Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:56.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations."}],"id":"CVE-2026-126472","lastModified":"2026-11-13T16:18:40.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126472","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:11.855427Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:56.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-6fxw-69cq-m7g6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-ccdaservice-ccda-gateway-php-c-cda-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126474.json b/data/2026/CVE-2026-126474.json
index 383882e7f6..708d875142 100644
--- a/data/2026/CVE-2026-126474.json
+++ b/data/2026/CVE-2026-126474.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration."}],"id":"CVE-2026-126474","lastModified":"2026-11-13T10:17:56.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.753","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mccm-83g2-7v57"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-acl-module-module-id-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration."}],"id":"CVE-2026-126474","lastModified":"2026-11-13T10:17:56.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.753","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mccm-83g2-7v57"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-acl-module-module-id-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126475.json b/data/2026/CVE-2026-126475.json
index 9e7708fcdf..501a585295 100644
--- a/data/2026/CVE-2026-126475.json
+++ b/data/2026/CVE-2026-126475.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data."}],"id":"CVE-2026-126475","lastModified":"2026-11-13T10:17:57.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.913","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pv5m-vjm7-x355"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-searcheleno-in-auto-suggest-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data."}],"id":"CVE-2026-126475","lastModified":"2026-11-13T10:17:57.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:56.913","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pv5m-vjm7-x355"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-searcheleno-in-auto-suggest-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126476.json b/data/2026/CVE-2026-126476.json
index 7e01efa6f7..5279cd4433 100644
--- a/data/2026/CVE-2026-126476.json
+++ b/data/2026/CVE-2026-126476.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data."}],"id":"CVE-2026-126476","lastModified":"2026-11-13T16:18:41.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:47.847781Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data."}],"id":"CVE-2026-126476","lastModified":"2026-11-13T16:18:41.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126476","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:47.847781Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8mwp-vq82-x5mr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-reflected-xss-via-auto-suggest-searchmode-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126477.json b/data/2026/CVE-2026-126477.json
index dbf9fb16d3..bfb74b0c0f 100644
--- a/data/2026/CVE-2026-126477.json
+++ b/data/2026/CVE-2026-126477.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults."}],"id":"CVE-2026-126477","lastModified":"2026-11-13T10:17:57.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gr77-7xgh-5gwf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-defaults-in-eye-base-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults."}],"id":"CVE-2026-126477","lastModified":"2026-11-13T10:17:57.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gr77-7xgh-5gwf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-eye-exam-defaults-in-eye-base-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126478.json b/data/2026/CVE-2026-126478.json
index 73aba162a4..919d887818 100644
--- a/data/2026/CVE-2026-126478.json
+++ b/data/2026/CVE-2026-126478.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information."}],"id":"CVE-2026-126478","lastModified":"2026-11-13T10:17:57.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.397","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q6f8-4pm7-q39r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-icd-codes-in-syndromic-surveillance"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information."}],"id":"CVE-2026-126478","lastModified":"2026-11-13T10:17:57.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.397","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-q6f8-4pm7-q39r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-icd-codes-in-syndromic-surveillance"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126479.json b/data/2026/CVE-2026-126479.json
index c362a7d854..e49c929bfa 100644
--- a/data/2026/CVE-2026-126479.json
+++ b/data/2026/CVE-2026-126479.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks."}],"id":"CVE-2026-126479","lastModified":"2026-11-13T10:17:57.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.563","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gpcx-xcp2-2rhx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-module-manager-installer-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks."}],"id":"CVE-2026-126479","lastModified":"2026-11-13T10:17:57.677","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.563","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-gpcx-xcp2-2rhx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-in-module-manager-installer-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126480.json b/data/2026/CVE-2026-126480.json
index c7e8fb61c3..b02469df13 100644
--- a/data/2026/CVE-2026-126480.json
+++ b/data/2026/CVE-2026-126480.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records."}],"id":"CVE-2026-126480","lastModified":"2026-11-13T16:18:42.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:09.432068Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.720","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records."}],"id":"CVE-2026-126480","lastModified":"2026-11-13T16:18:42.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:35:09.432068Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:57.720","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-86hf-j825-r56h"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ccr-revandapprove-parameter-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126481.json b/data/2026/CVE-2026-126481.json
index 6389ee3162..d9eaa5e02b 100644
--- a/data/2026/CVE-2026-126481.json
+++ b/data/2026/CVE-2026-126481.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server."}],"id":"CVE-2026-126481","lastModified":"2026-11-13T10:17:58.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mf55-7h68-r2rp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-path-traversal-via-era-835-file-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server."}],"id":"CVE-2026-126481","lastModified":"2026-11-13T10:17:58.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:57.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-mf55-7h68-r2rp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-path-traversal-via-era-835-file-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126482.json b/data/2026/CVE-2026-126482.json
index 4c9ebf8876..cecd387b96 100644
--- a/data/2026/CVE-2026-126482.json
+++ b/data/2026/CVE-2026-126482.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data."}],"id":"CVE-2026-126482","lastModified":"2026-11-13T10:17:58.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cw3f-mhw8-44jp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-clp01-element-of-x12-835-era-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data."}],"id":"CVE-2026-126482","lastModified":"2026-11-13T10:17:58.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.060","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-cw3f-mhw8-44jp"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-clp01-element-of-x12-835-era-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126483.json b/data/2026/CVE-2026-126483.json
index 6970697f67..0c036cd760 100644
--- a/data/2026/CVE-2026-126483.json
+++ b/data/2026/CVE-2026-126483.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents."}],"id":"CVE-2026-126483","lastModified":"2026-11-13T10:17:58.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.257","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-p2ch-6856-w69j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-facility-in-ippf-statistics-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents."}],"id":"CVE-2026-126483","lastModified":"2026-11-13T10:17:58.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.257","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-p2ch-6856-w69j"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-form-facility-in-ippf-statistics-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126484.json b/data/2026/CVE-2026-126484.json
index c551662119..640a932dfa 100644
--- a/data/2026/CVE-2026-126484.json
+++ b/data/2026/CVE-2026-126484.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session."}],"id":"CVE-2026-126484","lastModified":"2026-11-13T16:18:43.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126484","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:45.472489Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:58.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-c997-5w2m-grrf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-printed-fee-sheet-appointment-comments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session."}],"id":"CVE-2026-126484","lastModified":"2026-11-13T16:18:43.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126484","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:45.472489Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:58.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-c997-5w2m-grrf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-printed-fee-sheet-appointment-comments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126485.json b/data/2026/CVE-2026-126485.json
index 33687291e9..0d269265bb 100644
--- a/data/2026/CVE-2026-126485.json
+++ b/data/2026/CVE-2026-126485.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter."}],"id":"CVE-2026-126485","lastModified":"2026-11-13T10:17:58.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.587","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7gjr-359j-5q93"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-csrf-via-observation-form-delete-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter."}],"id":"CVE-2026-126485","lastModified":"2026-11-13T10:17:58.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.587","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-7gjr-359j-5q93"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-csrf-via-observation-form-delete-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126486.json b/data/2026/CVE-2026-126486.json
index 40d5710d71..78f6f2995e 100644
--- a/data/2026/CVE-2026-126486.json
+++ b/data/2026/CVE-2026-126486.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf."}],"id":"CVE-2026-126486","lastModified":"2026-11-13T10:17:58.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.750","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-phvv-q7m7-8mc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-portal-import-template-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf."}],"id":"CVE-2026-126486","lastModified":"2026-11-13T10:17:58.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.750","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-phvv-q7m7-8mc2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-missing-authorization-via-portal-import-template-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126487.json b/data/2026/CVE-2026-126487.json
index 59358a4fb8..e5cde85181 100644
--- a/data/2026/CVE-2026-126487.json
+++ b/data/2026/CVE-2026-126487.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions."}],"id":"CVE-2026-126487","lastModified":"2026-11-13T10:17:59.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.923","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-v997-jphq-wvvr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-global-configuration-override-via-user-settings-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions."}],"id":"CVE-2026-126487","lastModified":"2026-11-13T10:17:59.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:58.923","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-v997-jphq-wvvr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-global-configuration-override-via-user-settings-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126488.json b/data/2026/CVE-2026-126488.json
index de7e6ede17..26247abd70 100644
--- a/data/2026/CVE-2026-126488.json
+++ b/data/2026/CVE-2026-126488.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes."}],"id":"CVE-2026-126488","lastModified":"2026-11-13T16:18:44.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:43.032061Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes."}],"id":"CVE-2026-126488","lastModified":"2026-11-13T16:18:44.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:43.032061Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.087","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-g2xw-rvhq-x543"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsitedocument-query-bitwiseand"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126489.json b/data/2026/CVE-2026-126489.json
index fd9cd0c659..edc085e751 100644
--- a/data/2026/CVE-2026-126489.json
+++ b/data/2026/CVE-2026-126489.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL."}],"id":"CVE-2026-126489","lastModified":"2026-11-13T10:17:59.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8j6v-q545-q9q7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ippf-contraceptive-issue-feature"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL."}],"id":"CVE-2026-126489","lastModified":"2026-11-13T10:17:59.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.250","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-8j6v-q545-q9q7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ippf-contraceptive-issue-feature"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126490.json b/data/2026/CVE-2026-126490.json
index e463b71939..dc9be2a1c9 100644
--- a/data/2026/CVE-2026-126490.json
+++ b/data/2026/CVE-2026-126490.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru(\"groups\") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning."}],"id":"CVE-2026-126490","lastModified":"2026-11-13T10:17:59.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc2f-fvpv-c32r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-debug-code-in-fax-view-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru(\"groups\") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning."}],"id":"CVE-2026-126490","lastModified":"2026-11-13T10:17:59.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.423","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-wc2f-fvpv-c32r"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-information-disclosure-via-debug-code-in-fax-view-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126491.json b/data/2026/CVE-2026-126491.json
index 819100f117..bf2adfc694 100644
--- a/data/2026/CVE-2026-126491.json
+++ b/data/2026/CVE-2026-126491.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any authenticated low-privilege user to exfiltrate data from patient_data and users_secure tables."}],"id":"CVE-2026-126491","lastModified":"2026-11-13T10:17:59.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pc2q-9pcw-v899"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-getbypatientdemographics-in-patient-inc-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any authenticated low-privilege user to exfiltrate data from patient_data and users_secure tables."}],"id":"CVE-2026-126491","lastModified":"2026-11-13T10:17:59.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-pc2q-9pcw-v899"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-getbypatientdemographics-in-patient-inc-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126492.json b/data/2026/CVE-2026-126492.json
index dc991ca6ac..c3142eb4dc 100644
--- a/data/2026/CVE-2026-126492.json
+++ b/data/2026/CVE-2026-126492.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL."}],"id":"CVE-2026-126492","lastModified":"2026-11-13T16:18:45.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:40.673448Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL."}],"id":"CVE-2026-126492","lastModified":"2026-11-13T16:18:45.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:40.673448Z","version":"2.0.3"}}]},"published":"2026-11-13T10:17:59.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-hrf6-qx6w-vgh9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-second-order-sql-injection-via-dynamic-finder-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126493.json b/data/2026/CVE-2026-126493.json
index 7bb1cdbc12..1a1f9f755d 100644
--- a/data/2026/CVE-2026-126493.json
+++ b/data/2026/CVE-2026-126493.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page."}],"id":"CVE-2026-126493","lastModified":"2026-11-13T10:18:00.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.930","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r4hm-frcj-qr39"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-onsiteportalactivity-tableargs"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"openemr","vendor":"openemr","versions":[{"lessThan":"8.5.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"8.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page."}],"id":"CVE-2026-126493","lastModified":"2026-11-13T10:18:00.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:17:59.930","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/openemr/openemr/security/advisories/GHSA-r4hm-frcj-qr39"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-stored-xss-via-onsiteportalactivity-tableargs"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-126495.json b/data/2026/CVE-2026-126495.json
index 227e6eca52..438be771c4 100644
--- a/data/2026/CVE-2026-126495.json
+++ b/data/2026/CVE-2026-126495.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/emqx/MQTTX","product":"MQTTX","repo":"https://github.com/emqx/MQTTX","vendor":"emqx","versions":[{"lessThanOrEqual":"1.13.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes."}],"id":"CVE-2026-126495","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:14.187","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/issues/2180"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/emqx/MQTTX","product":"MQTTX","repo":"https://github.com/emqx/MQTTX","vendor":"emqx","versions":[{"lessThanOrEqual":"1.13.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes."}],"id":"CVE-2026-126495","lastModified":"2026-11-13T17:17:25.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126495","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:46:09.304602Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:14.187","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226"},{"source":"disclosure@vulncheck.com","url":"https://github.com/emqx/MQTTX/issues/2180"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126499.json b/data/2026/CVE-2026-126499.json
index 8f2bf38e1e..6494f7762c 100644
--- a/data/2026/CVE-2026-126499.json
+++ b/data/2026/CVE-2026-126499.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jellyfin/jellyfin","product":"jellyfin","repo":"https://github.com/jellyfin/jellyfin","vendor":"jellyfin","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db."}],"id":"CVE-2026-126499","lastModified":"2026-11-11T01:17:15.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:14.963","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/releases/tag/v12.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jellyfin/jellyfin","product":"jellyfin","repo":"https://github.com/jellyfin/jellyfin","vendor":"jellyfin","versions":[{"lessThan":"12.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db."}],"id":"CVE-2026-126499","lastModified":"2026-11-13T17:17:25.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:47:00.596822Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:14.963","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/releases/tag/v12.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126543.json b/data/2026/CVE-2026-126543.json
index 0212eafd5e..12d59f5bfd 100644
--- a/data/2026/CVE-2026-126543.json
+++ b/data/2026/CVE-2026-126543.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle."}],"id":"CVE-2026-126543","lastModified":"2026-11-11T01:17:15.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T01:17:15.727","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php#L87-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-wallet-credit-manipulation-via-paypalypt-ipnv2-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","repo":"https://github.com/WWBN/AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal account with a chosen users_id to add wallet balance each billing cycle."}],"id":"CVE-2026-126543","lastModified":"2026-11-13T17:17:25.913","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126543","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:32:32.923717Z","version":"2.0.3"}}]},"published":"2026-11-11T01:17:15.727","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/PayPalYPT/ipnV2.php#L87-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/98406b7944e035e72082665ac886d78fc3af0a7f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-wallet-credit-manipulation-via-paypalypt-ipnv2-php"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-5gg3-9jhh-xf86"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126559.json b/data/2026/CVE-2026-126559.json
index c9b8960484..c0371c7327 100644
--- a/data/2026/CVE-2026-126559.json
+++ b/data/2026/CVE-2026-126559.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"4.2.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators."}],"id":"CVE-2026-126559","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:49.797","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/FacetedSearch/OptionsBuilder.php#L27-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/92999fc0de74324aaa35bfd3676cd4d145d2ac06"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-cw86-j46r-2x7x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-4.2.0-before-7.4.1-stored-xss-via-special-facetedsearch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"4.2.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles() that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCH_PROFILE_SCHEMA profile keys or labels that break out of option elements, executing scripts for every Special:FacetedSearch visitor including administrators."}],"id":"CVE-2026-126559","lastModified":"2026-11-13T17:17:26.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126559","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:34:09.270712Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:49.797","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/FacetedSearch/OptionsBuilder.php#L27-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/92999fc0de74324aaa35bfd3676cd4d145d2ac06"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-cw86-j46r-2x7x"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-4.2.0-before-7.4.1-stored-xss-via-special-facetedsearch"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-cw86-j46r-2x7x"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126563.json b/data/2026/CVE-2026-126563.json
index adaf012969..faad334fba 100644
--- a/data/2026/CVE-2026-126563.json
+++ b/data/2026/CVE-2026-126563.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session."}],"id":"CVE-2026-126563","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:50.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/DataValues/ValueFormatters/TimeValueFormatter.php#L312-L340"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/01cb81a6da7af743d2a5eb334db10e52b7318c56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.4.0-before-7.4.1-reflected-xss-via-special-ask-date-format"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat(), which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout format (#-F[...]) to execute script in a logged-in victim's browser session."}],"id":"CVE-2026-126563","lastModified":"2026-11-13T17:17:26.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126563","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:54:30.647052Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:50.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/DataValues/ValueFormatters/TimeValueFormatter.php#L312-L340"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/01cb81a6da7af743d2a5eb334db10e52b7318c56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.4.0-before-7.4.1-reflected-xss-via-special-ask-date-format"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-h252-mj7p-58q7"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126567.json b/data/2026/CVE-2026-126567.json
index 9214749fa6..3bc0ef8495 100644
--- a/data/2026/CVE-2026-126567.json
+++ b/data/2026/CVE-2026-126567.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session."}],"id":"CVE-2026-126567","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T03:16:51.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/SpecialAsk.php#L512-L521"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Query/ScoreSet.php#L128-L140"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/fca9922835f4353e67a71cfef4d527d46e7c3ad3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7j96-w9cc-r7rq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-special-ask-debug-output"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/mediawiki/semantic-media-wiki","product":"SemanticMediaWiki","repo":"https://github.com/SemanticMediaWiki/SemanticMediaWiki","vendor":"SemanticMediaWiki","versions":[{"lessThan":"7.4.1","status":"affected","version":"3.0.0","versionType":"semver"},{"status":"unaffected","version":"7.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session."}],"id":"CVE-2026-126567","lastModified":"2026-11-13T17:17:26.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126567","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:57:12.864117Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:51.237","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/MediaWiki/Specials/SpecialAsk.php#L512-L521"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/blob/7.4.0/src/Query/ScoreSet.php#L128-L140"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/fca9922835f4353e67a71cfef4d527d46e7c3ad3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7j96-w9cc-r7rq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.4.1-stored-xss-via-special-ask-debug-output"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7j96-w9cc-r7rq"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126658.json b/data/2026/CVE-2026-126658.json
index 897f119999..4a97ebfc55 100644
--- a/data/2026/CVE-2026-126658.json
+++ b/data/2026/CVE-2026-126658.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jordan-dalby/ByteStash","product":"ByteStash","repo":"https://github.com/jordan-dalby/ByteStash","vendor":"jordan-dalby","versions":[{"lessThan":"1.6.2","status":"affected","version":"1.5.10","versionType":"semver"},{"status":"unaffected","version":"1.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp."}],"id":"CVE-2026-126658","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T13:17:23.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jordan-dalby/ByteStash","product":"ByteStash","repo":"https://github.com/jordan-dalby/ByteStash","vendor":"jordan-dalby","versions":[{"lessThan":"1.6.2","status":"affected","version":"1.5.10","versionType":"semver"},{"status":"unaffected","version":"1.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp."}],"id":"CVE-2026-126658","lastModified":"2026-11-13T18:17:32.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126658","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:11:13.917901Z","version":"2.0.3"}}]},"published":"2026-11-11T13:17:23.993","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/blob/v1.6.1/server/src/repositories/apiKeyRepository.js#L70-L78"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126766.json b/data/2026/CVE-2026-126766.json
index 2e16e19e8f..a906dc9517 100644
--- a/data/2026/CVE-2026-126766.json
+++ b/data/2026/CVE-2026-126766.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail."}],"id":"CVE-2026-126766","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:36.847","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-reporter-spoofing-via-api-v1-incidents"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an incident's reporter to another user by supplying a client-controlled reporter field. Attackers can send crafted POST /api/v1/incidents or PATCH /api/v1/incidents/{id}/status requests to falsify incident attribution and corrupt the accountability audit trail."}],"id":"CVE-2026-126766","lastModified":"2026-11-13T18:17:32.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126766","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:27:59.983597Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:36.847","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/e11fb4f70d8ec850fa601566b95472a4"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-reporter-spoofing-via-api-v1-incidents"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126770.json b/data/2026/CVE-2026-126770.json
index 73ca876152..92a846c89f 100644
--- a/data/2026/CVE-2026-126770.json
+++ b/data/2026/CVE-2026-126770.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server."}],"id":"CVE-2026-126770","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:37.450","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/3c4a44d71e8f08747fbac13b2be87427"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-ssrf-via-database-test-connection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"REMS","vendor":"OpsTree Solutions","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, or attacker-controlled servers to probe internal hosts and ports reachable from the REMS server."}],"id":"CVE-2026-126770","lastModified":"2026-11-13T18:17:33.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126770","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:28:29.976335Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:37.450","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/neelkotnis/3c4a44d71e8f08747fbac13b2be87427"},{"source":"disclosure@vulncheck.com","url":"https://opstree.com/rems-ai-powered-observability/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/opstree-rems-through-1.0.0-ssrf-via-database-test-connection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126775.json b/data/2026/CVE-2026-126775.json
index 8468804fed..07a9ad2edb 100644
--- a/data/2026/CVE-2026-126775.json
+++ b/data/2026/CVE-2026-126775.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageURL":"pkg:pypi/social-auth-core","product":"social-auth-core","repo":"https://github.com/python-social-auth/social-core","vendor":"python-social-auth","versions":[{"lessThan":"7.0.0","status":"affected","version":"4.7.0","versionType":"semver"},{"status":"unaffected","version":"7.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data."}],"id":"CVE-2026-126775","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.110","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/commit/7d9da571fc9ce8bd0003ccfcbfa8ed98c18bb640"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/pull/2167"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/releases/tag/7.0.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-4pv2-52v7-vrfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/social-auth-core-4.7.0-before-7.0.0-login-csrf-via-saml-relaystate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageURL":"pkg:pypi/social-auth-core","product":"social-auth-core","repo":"https://github.com/python-social-auth/social-core","vendor":"python-social-auth","versions":[{"lessThan":"7.0.0","status":"affected","version":"4.7.0","versionType":"semver"},{"status":"unaffected","version":"7.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data."}],"id":"CVE-2026-126775","lastModified":"2026-11-13T18:17:33.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:35:20.854470Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:38.110","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/commit/7d9da571fc9ce8bd0003ccfcbfa8ed98c18bb640"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/pull/2167"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/releases/tag/7.0.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-4pv2-52v7-vrfx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/social-auth-core-4.7.0-before-7.0.0-login-csrf-via-saml-relaystate"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126779.json b/data/2026/CVE-2026-126779.json
index 10d28470a3..a12d58d500 100644
--- a/data/2026/CVE-2026-126779.json
+++ b/data/2026/CVE-2026-126779.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageURL":"pkg:composer/spatie/browsershot","product":"browsershot","repo":"https://github.com/spatie/browsershot","vendor":"spatie","versions":[{"lessThan":"5.5.0","status":"affected","version":"2.2.0","versionType":"semver"},{"status":"unaffected","version":"5.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot."}],"id":"CVE-2026-126779","lastModified":"2026-11-12T20:28:31.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T19:17:38.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/pull/989"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/releases/tag/5.5.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","packageURL":"pkg:composer/spatie/browsershot","product":"browsershot","repo":"https://github.com/spatie/browsershot","vendor":"spatie","versions":[{"lessThan":"5.5.0","status":"affected","version":"2.2.0","versionType":"semver"},{"status":"unaffected","version":"5.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing paths like /etc/passwd, which resolve to file:// URLs and render file contents into the returned PDF or screenshot."}],"id":"CVE-2026-126779","lastModified":"2026-11-13T18:17:33.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126779","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:37:51.283314Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:38.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/blob/2.2.0/src/Browsershot.php#L242-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/commit/eba71ab7f4aba23d9321d653ccd19d4e94432516"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/pull/989"},{"source":"disclosure@vulncheck.com","url":"https://github.com/spatie/browsershot/releases/tag/5.5.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/spatie-browsershot-2.2.0-before-5.5.0-local-file-read-via-sethtml"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126798.json b/data/2026/CVE-2026-126798.json
index 8bd74bb148..898ff21d69 100644
--- a/data/2026/CVE-2026-126798.json
+++ b/data/2026/CVE-2026-126798.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."}],"id":"CVE-2026-126798","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/49"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators."}],"id":"CVE-2026-126798","lastModified":"2026-11-13T18:17:33.580","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126798","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:45:32.680534Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:43.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/49"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-stored-xss-via-url-asset-detail-view"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://vul.yulun.ac.cn/20261107/nextscan/"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126802.json b/data/2026/CVE-2026-126802.json
index 96a35e0532..63b0180342 100644
--- a/data/2026/CVE-2026-126802.json
+++ b/data/2026/CVE-2026-126802.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."}],"id":"CVE-2026-126802","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:43.837","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/50"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:docker/lysec/ns-admin","product":"NextScan","vendor":"tongcheng-security-team","versions":[{"lessThanOrEqual":"1.2.0","status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis passwords, etcd details and the server token, and impersonate scan nodes via registration, heartbeat and logging endpoints."}],"id":"CVE-2026-126802","lastModified":"2026-11-13T18:17:33.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126802","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:47:03.521361Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:43.837","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tongcheng-security-team/NextScan/issues/50"},{"source":"disclosure@vulncheck.com","url":"https://hub.docker.com/r/lysec/ns-admin"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/nextscan/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nextscan-1.1.0-through-1.2.0-hardcoded-credentials-in-ns-admin-agent-and-external-apis"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://vul.yulun.ac.cn/20261107/nextscan/"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-798"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126806.json b/data/2026/CVE-2026-126806.json
index 5532d26072..9d1fa50eb2 100644
--- a/data/2026/CVE-2026-126806.json
+++ b/data/2026/CVE-2026-126806.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"14.3","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP."}],"id":"CVE-2026-126806","lastModified":"2026-11-11T21:16:44.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:44.583","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"14.3","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP."}],"id":"CVE-2026-126806","lastModified":"2026-11-13T18:17:33.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126806","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:47:53.277269Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:44.583","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126810.json b/data/2026/CVE-2026-126810.json
index 8f46cf2bf2..6ed22fcd8c 100644
--- a/data/2026/CVE-2026-126810.json
+++ b/data/2026/CVE-2026-126810.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"29.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed."}],"id":"CVE-2026-126810","lastModified":"2026-11-11T21:16:45.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:45.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/WWBN/AVideo","product":"AVideo","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"29.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed."}],"id":"CVE-2026-126810","lastModified":"2026-11-13T18:17:33.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126810","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:49:03.555643Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:45.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126814.json b/data/2026/CVE-2026-126814.json
index 723088b17a..e1a21d17c6 100644
--- a/data/2026/CVE-2026-126814.json
+++ b/data/2026/CVE-2026-126814.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.6","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads."}],"id":"CVE-2026-126814","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T21:16:46.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.5/app/services/www/BlueprintService.php#L700-L716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/5f13e2bb8cd4c620899e9f8afd41a6e62b3bc6a4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/269"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.6-arbitrary-iframe-embedding-via-peertube-matcher"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.6","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads."}],"id":"CVE-2026-126814","lastModified":"2026-11-13T18:17:34.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126814","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:51:46.929660Z","version":"2.0.3"}}]},"published":"2026-11-11T21:16:46.053","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.5/app/services/www/BlueprintService.php#L700-L716"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/5f13e2bb8cd4c620899e9f8afd41a6e62b3bc6a4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/269"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.6-arbitrary-iframe-embedding-via-peertube-matcher"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-3vgc-fcfg-v233"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126835.json b/data/2026/CVE-2026-126835.json
index 363c73f2ac..dd090c4d44 100644
--- a/data/2026/CVE-2026-126835.json
+++ b/data/2026/CVE-2026-126835.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Node.js Driver","vendor":"MongoDB","versions":[{"lessThan":"7.9.0","status":"affected","version":">= 6.7.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver."}],"id":"CVE-2026-126835","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T17:17:33.147","references":[{"source":"cna@mongodb.com","url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Node.js Driver","vendor":"MongoDB","versions":[{"lessThan":"7.9.0","status":"affected","version":">= 6.7.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver."}],"id":"CVE-2026-126835","lastModified":"2026-11-13T17:17:26.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:50:31.538740Z","version":"2.0.3"}}]},"published":"2026-11-12T17:17:33.147","references":[{"source":"cna@mongodb.com","url":"https://github.com/mongodb/node-mongodb-native/releases/tag/v7.9.0"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-923"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126838.json b/data/2026/CVE-2026-126838.json
index 523513959e..26517ae978 100644
--- a/data/2026/CVE-2026-126838.json
+++ b/data/2026/CVE-2026-126838.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Rust Driver","vendor":"MongoDB","versions":[{"lessThan":"3.9.1","status":"affected","version":"3.9.0","versionType":"semver"},{"lessThan":"3.8.2","status":"affected","version":"3.8.0","versionType":"semver"},{"status":"affected","version":"3.7.0","versionType":"semver"},{"status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"3.5.2","status":"affected","version":"3.5.0","versionType":"semver"},{"lessThan":"3.4.1","status":"affected","version":"3.4.0","versionType":"semver"},{"status":"affected","version":"3.3.0","versionType":"semver"},{"lessThan":"3.2.5","status":"affected","version":"3.2.0","versionType":"semver"},{"lessThan":"3.1.1","status":"affected","version":"3.1.0","versionType":"semver"},{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"2.8.2","status":"affected","version":"2.8.0","versionType":"semver"},{"lessThan":"2.7.1","status":"affected","version":"2.7.0","versionType":"semver"},{"lessThan":"2.6.1","status":"affected","version":"2.6.0","versionType":"semver"},{"status":"affected","version":"2.5.0","versionType":"semver"},{"status":"affected","version":"2.4.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material."}],"id":"CVE-2026-126838","lastModified":"2026-11-12T19:17:01.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}]},"published":"2026-11-12T19:17:01.570","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/RUST-2531"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"cna@mongodb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Rust Driver","vendor":"MongoDB","versions":[{"lessThan":"3.9.1","status":"affected","version":"3.9.0","versionType":"semver"},{"lessThan":"3.8.2","status":"affected","version":"3.8.0","versionType":"semver"},{"status":"affected","version":"3.7.0","versionType":"semver"},{"status":"affected","version":"3.6.0","versionType":"semver"},{"lessThan":"3.5.2","status":"affected","version":"3.5.0","versionType":"semver"},{"lessThan":"3.4.1","status":"affected","version":"3.4.0","versionType":"semver"},{"status":"affected","version":"3.3.0","versionType":"semver"},{"lessThan":"3.2.5","status":"affected","version":"3.2.0","versionType":"semver"},{"lessThan":"3.1.1","status":"affected","version":"3.1.0","versionType":"semver"},{"lessThan":"3.0.1","status":"affected","version":"3.0.0","versionType":"semver"},{"lessThan":"2.8.2","status":"affected","version":"2.8.0","versionType":"semver"},{"lessThan":"2.7.1","status":"affected","version":"2.7.0","versionType":"semver"},{"lessThan":"2.6.1","status":"affected","version":"2.6.0","versionType":"semver"},{"status":"affected","version":"2.5.0","versionType":"semver"},{"status":"affected","version":"2.4.0","versionType":"semver"}]}],"source":"cna@mongodb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may place that material where a party with read access to the application's diagnostic output can see it, which may result in unintended disclosure of key material."}],"id":"CVE-2026-126838","lastModified":"2026-11-13T17:17:26.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"cna@mongodb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@mongodb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126838","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:49:22.379896Z","version":"2.0.3"}}]},"published":"2026-11-12T19:17:01.570","references":[{"source":"cna@mongodb.com","url":"https://jira.mongodb.org/browse/RUST-2531"}],"sourceIdentifier":"cna@mongodb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"cna@mongodb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126848.json b/data/2026/CVE-2026-126848.json
index 5bcd4e7ef8..dd3044438a 100644
--- a/data/2026/CVE-2026-126848.json
+++ b/data/2026/CVE-2026-126848.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126848","lastModified":"2026-11-12T19:17:02.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:20.402133Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685477"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126848","lastModified":"2026-11-13T17:34:16.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:20.402133Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.650","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578685477"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126850.json b/data/2026/CVE-2026-126850.json
index 95f6232e42..5a1b1c4c65 100644
--- a/data/2026/CVE-2026-126850.json
+++ b/data/2026/CVE-2026-126850.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126850","lastModified":"2026-11-12T18:17:29.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:59.630744Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.937","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580853808"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:google:android:-:*:*:*:*:*:*:*","matchCriteriaId":"F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126850","lastModified":"2026-11-13T17:33:57.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:59.630744Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:12.937","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/580853808"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126853.json b/data/2026/CVE-2026-126853.json
index 3792ac9465..313d50cb0f 100644
--- a/data/2026/CVE-2026-126853.json
+++ b/data/2026/CVE-2026-126853.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126853","lastModified":"2026-11-12T19:17:02.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:29.688421Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.327","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573263421"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126853","lastModified":"2026-11-13T17:33:44.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:29.688421Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.327","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/573263421"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126854.json b/data/2026/CVE-2026-126854.json
index 989753ba9f..76b0b9a640 100644
--- a/data/2026/CVE-2026-126854.json
+++ b/data/2026/CVE-2026-126854.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126854","lastModified":"2026-11-12T18:17:29.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:08.955854Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.473","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578655807"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126854","lastModified":"2026-11-13T17:33:30.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126854","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:08.955854Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.473","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578655807"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126855.json b/data/2026/CVE-2026-126855.json
index 46cf324ae5..565a8cd98f 100644
--- a/data/2026/CVE-2026-126855.json
+++ b/data/2026/CVE-2026-126855.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126855","lastModified":"2026-11-12T18:17:30.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126855","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:42.950737Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.610","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579300424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126855","lastModified":"2026-11-13T17:33:17.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126855","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:42.950737Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.610","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/579300424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126856.json b/data/2026/CVE-2026-126856.json
index dfac0a290d..a286bd22f6 100644
--- a/data/2026/CVE-2026-126856.json
+++ b/data/2026/CVE-2026-126856.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126856","lastModified":"2026-11-12T18:17:30.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:22.043612Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.747","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577260644"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126856","lastModified":"2026-11-13T17:33:03.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126856","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:22.043612Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.747","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/577260644"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126857.json b/data/2026/CVE-2026-126857.json
index e6719ec370..09d7d16900 100644
--- a/data/2026/CVE-2026-126857.json
+++ b/data/2026/CVE-2026-126857.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126857","lastModified":"2026-11-12T18:17:31.493","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:02.632859Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.883","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656869"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126857","lastModified":"2026-11-13T17:32:49.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:27:02.632859Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:13.883","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578656869"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126858.json b/data/2026/CVE-2026-126858.json
index 0357301e9f..c1603820e4 100644
--- a/data/2026/CVE-2026-126858.json
+++ b/data/2026/CVE-2026-126858.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126858","lastModified":"2026-11-12T18:17:32.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126858","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:48:04.810108Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.010","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575937643"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126858","lastModified":"2026-11-13T17:32:29.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126858","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:48:04.810108Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:14.010","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575937643"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126878.json b/data/2026/CVE-2026-126878.json
index 505bfd8a81..e9b1a5527c 100644
--- a/data/2026/CVE-2026-126878.json
+++ b/data/2026/CVE-2026-126878.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126878","lastModified":"2026-11-12T20:18:34.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:59:21.048272Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.723","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572312779"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126878","lastModified":"2026-11-13T17:32:10.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126878","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T19:59:21.048272Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:16.723","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/572312779"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126882.json b/data/2026/CVE-2026-126882.json
index b3d5a45dcb..d94e9fd89a 100644
--- a/data/2026/CVE-2026-126882.json
+++ b/data/2026/CVE-2026-126882.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126882","lastModified":"2026-11-12T19:17:02.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:29:43.071817Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.270","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685706"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126882","lastModified":"2026-11-13T17:31:55.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126882","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:29:43.071817Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.270","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578685706"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126884.json b/data/2026/CVE-2026-126884.json
index 33f50c2e21..304427e585 100644
--- a/data/2026/CVE-2026-126884.json
+++ b/data/2026/CVE-2026-126884.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126884","lastModified":"2026-11-12T18:17:35.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:39:10.422898Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.523","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576949530"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126884","lastModified":"2026-11-13T18:01:53.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:39:10.422898Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:17.523","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576949530"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126891.json b/data/2026/CVE-2026-126891.json
index 1667b4a61b..378298d4cd 100644
--- a/data/2026/CVE-2026-126891.json
+++ b/data/2026/CVE-2026-126891.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126891","lastModified":"2026-11-12T18:17:35.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:34:48.306282Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.460","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575939904"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126891","lastModified":"2026-11-13T17:58:52.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:34:48.306282Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.460","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/575939904"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126894.json b/data/2026/CVE-2026-126894.json
index bffc8c5e8b..15529650cf 100644
--- a/data/2026/CVE-2026-126894.json
+++ b/data/2026/CVE-2026-126894.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126894","lastModified":"2026-11-12T18:17:36.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:23.350700Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.890","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576950618"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126894","lastModified":"2026-11-13T17:56:54.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126894","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:30:23.350700Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:18.890","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/576950618"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126903.json b/data/2026/CVE-2026-126903.json
index f0246ed08c..683b1025dd 100644
--- a/data/2026/CVE-2026-126903.json
+++ b/data/2026/CVE-2026-126903.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126903","lastModified":"2026-11-12T19:17:02.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126903","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:31.734928Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.133","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574035865"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126903","lastModified":"2026-11-13T17:54:33.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126903","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:46:31.734928Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.133","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/574035865"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126906.json b/data/2026/CVE-2026-126906.json
index daf40919ac..5b18b32518 100644
--- a/data/2026/CVE-2026-126906.json
+++ b/data/2026/CVE-2026-126906.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"id":"CVE-2026-126906","lastModified":"2026-11-12T18:17:37.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:18.116823Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578693038"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"id":"CVE-2026-126906","lastModified":"2026-11-13T17:54:15.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126906","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:38:18.116823Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.553","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/578693038"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-126907.json b/data/2026/CVE-2026-126907.json
index eacd89ed46..dc5b77deca 100644
--- a/data/2026/CVE-2026-126907.json
+++ b/data/2026/CVE-2026-126907.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126907","lastModified":"2026-11-12T19:17:03.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:27.407627Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.697","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574791611"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*","matchCriteriaId":"8F6B0625-AEDC-487A-87B8-8BB68A506D55","versionEndExcluding":"157.0.8103.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126907","lastModified":"2026-11-13T17:53:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-126907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:27.407627Z","version":"2.0.3"}}]},"published":"2026-11-11T23:17:20.697","references":[{"source":"chrome-cve-admin@google.com","tags":["Release Notes","Vendor Advisory"],"url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","tags":["Permissions Required"],"url":"https://issues.chromium.org/issues/574791611"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127208.json b/data/2026/CVE-2026-127208.json
index 7fd4fd7052..b0c8940597 100644
--- a/data/2026/CVE-2026-127208.json
+++ b/data/2026/CVE-2026-127208.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/datamodel-code-generator","product":"datamodel-code-generator","repo":"https://github.com/datamodel-code-generator/datamodel-code-generator","vendor":"datamodel-code-generator","versions":[{"lessThan":"0.84.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime."}],"id":"CVE-2026-127208","lastModified":"2026-11-12T21:17:23.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-12T21:17:22.933","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/datamodel-code-generator/datamodel-code-generator/commit/ebfc11d0644d37a71374b28aac06d98748e584ec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.84.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-x-python-type-annotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/datamodel-code-generator","product":"datamodel-code-generator","repo":"https://github.com/datamodel-code-generator/datamodel-code-generator","vendor":"datamodel-code-generator","versions":[{"lessThan":"0.84.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse_python_type_annotation and _python_type_expr_from_ast. Attackers can embed malicious Python expressions such as __import__ calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model_rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime."}],"id":"CVE-2026-127208","lastModified":"2026-11-13T17:17:26.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:34:54.409817Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:22.933","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/datamodel-code-generator/datamodel-code-generator/commit/ebfc11d0644d37a71374b28aac06d98748e584ec"},{"source":"disclosure@vulncheck.com","url":"https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.84.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/datamodel-code-generator-code-injection-via-x-python-type-annotation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127281.json b/data/2026/CVE-2026-127281.json
index 6cf287827c..b81a8604a3 100644
--- a/data/2026/CVE-2026-127281.json
+++ b/data/2026/CVE-2026-127281.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:lanyulei:ferry:*:*:*:*:*:*:*:*"],"modules":["JWT Validation"],"product":"ferry","vendor":"lanyulei","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.0.0-beta.1"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127281","lastModified":"2026-11-13T02:18:55.253","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T02:18:55.103","references":[{"source":"cna@vuldb.com","url":"https://github.com/liumiya63-arch/CVE/blob/main/ferry-CVE-en-20261018/CVE-ferry-jwt-auth-bypass.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127281"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041008"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041009"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436447"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436447/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:lanyulei:ferry:*:*:*:*:*:*:*:*"],"modules":["JWT Validation"],"product":"ferry","vendor":"lanyulei","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.0.0-beta.1"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in lanyulei ferry 1.0.0-beta.1/1.0.0. Affected is an unknown function of the file middleware/auth.go of the component JWT Validation. The manipulation results in improper authentication. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127281","lastModified":"2026-11-13T18:17:34.283","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127281","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:43:05.293699Z","version":"2.0.3"}}]},"published":"2026-11-13T02:18:55.103","references":[{"source":"cna@vuldb.com","url":"https://github.com/liumiya63-arch/CVE/blob/main/ferry-CVE-en-20261018/CVE-ferry-jwt-auth-bypass.md"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127281"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041008"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1041009"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436447"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436447/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-127285.json b/data/2026/CVE-2026-127285.json
index ee7d5984f4..8f31eb17b4 100644
--- a/data/2026/CVE-2026-127285.json
+++ b/data/2026/CVE-2026-127285.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:cairo-dock:glx-dock:*:*:*:*:*:*:*:*"],"modules":["href Attribute Handler"],"product":"Glx-Dock","vendor":"Cairo-dock","versions":[{"status":"affected","version":"3.4.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127285","lastModified":"2026-11-13T03:17:30.063","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-13T03:17:29.913","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127285"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042362"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436454"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436454/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:cairo-dock:glx-dock:*:*:*:*:*:*:*:*"],"modules":["href Attribute Handler"],"product":"Glx-Dock","vendor":"Cairo-dock","versions":[{"status":"affected","version":"3.4.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-127285","lastModified":"2026-11-13T18:17:34.423","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-127285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:43:44.888305Z","version":"2.0.3"}}]},"published":"2026-11-13T03:17:29.913","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-127285"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1042362"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436454"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/436454/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128028.json b/data/2026/CVE-2026-128028.json
index fa1613a0cb..226977489b 100644
--- a/data/2026/CVE-2026-128028.json
+++ b/data/2026/CVE-2026-128028.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin."}],"id":"CVE-2026-128028","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:08.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin."}],"id":"CVE-2026-128028","lastModified":"2026-11-13T17:17:26.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128028","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:20.984848Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:08.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5896b2a60b10e892cec594391b2612ab53a4ce59"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-v7mx-rv47-452m"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-custom-option-svg-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128032.json b/data/2026/CVE-2026-128032.json
index 5306218a62..377b30e056 100644
--- a/data/2026/CVE-2026-128032.json
+++ b/data/2026/CVE-2026-128032.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."}],"id":"CVE-2026-128032","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."}],"id":"CVE-2026-128032","lastModified":"2026-11-13T17:17:27.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:18.635951Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:09.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-841"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128042.json b/data/2026/CVE-2026-128042.json
index 1483f4594e..66684b73ac 100644
--- a/data/2026/CVE-2026-128042.json
+++ b/data/2026/CVE-2026-128042.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows."}],"id":"CVE-2026-128042","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:09.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.19.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.19.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows."}],"id":"CVE-2026-128042","lastModified":"2026-11-13T17:17:27.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:16.480363Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:09.843","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2626f027a752cda004c5cf7f8f9bd3cf52f525f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-5rg7-22cv-c9q6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.19.0-race-condition-in-coupon-usage-limits"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128046.json b/data/2026/CVE-2026-128046.json
index fbec7721c0..38e45d72b7 100644
--- a/data/2026/CVE-2026-128046.json
+++ b/data/2026/CVE-2026-128046.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"20.17.0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory."}],"id":"CVE-2026-128046","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"20.17.0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory."}],"id":"CVE-2026-128046","lastModified":"2026-11-13T17:17:27.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:34:58.924896Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:10.400","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128051.json b/data/2026/CVE-2026-128051.json
index 1e2be34b09..ab7522a710 100644
--- a/data/2026/CVE-2026-128051.json
+++ b/data/2026/CVE-2026-128051.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages."}],"id":"CVE-2026-128051","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"20.18.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"20.18.2","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"magento-lts","vendor":"OpenMage","versions":[{"lessThan":"21.0.0-beta3","status":"affected","version":"21.0.0-beta1","versionType":"semver"},{"status":"unaffected","version":"21.0.0-beta3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages."}],"id":"CVE-2026-128051","lastModified":"2026-11-13T17:17:27.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128051","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:14.254132Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:10.957","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/2437b01af99279aa1c6ca5c19f919449b38a5a66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/commit/64ff7fce3db72cad83e41131bdf48c42ba2ad2f2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenMage/magento-lts/security/advisories/GHSA-hfqq-c3qm-38x8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-product-name-in-msrp-popup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128067.json b/data/2026/CVE-2026-128067.json
index 407f548648..b51e85040a 100644
--- a/data/2026/CVE-2026-128067.json
+++ b/data/2026/CVE-2026-128067.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"Pillow","vendor":"python-pillow","versions":[{"status":"affected","version":">= 2.3.0, < 13.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0."}],"id":"CVE-2026-128067","lastModified":"2026-11-13T00:20:14.853","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T00:20:14.710","references":[{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"Pillow","vendor":"python-pillow","versions":[{"status":"affected","version":">= 2.3.0, < 13.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0."}],"id":"CVE-2026-128067","lastModified":"2026-11-13T17:17:27.567","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:58.565281Z","version":"2.0.3"}}]},"published":"2026-11-13T00:20:14.710","references":[{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/commit/53318b50e8e9e85a57d033d4d879e1398d97aeb1"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/commit/ec5f1cbcf67275641abaad5c065ffb64a0a804a9"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"security-advisories@github.com","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xcvg-w56q-r89m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128068.json b/data/2026/CVE-2026-128068.json
new file mode 100644
index 0000000000..12f5fabe08
--- /dev/null
+++ b/data/2026/CVE-2026-128068.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"rails-html-sanitizer","vendor":"rails","versions":[{"status":"affected","version":">= 1.0.3, < 1.7.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an all-whitespace value to be rescanned from each line start. An attacker who supplies HTML can cause quadratic CPU consumption when an application customizes its allowed tags to include an SVG reference element such as use and permits href or xlink:href. The default allowed tag configuration is not affected. CRuby 3.2 and later uses linear-time regular expression matching for this pattern, while CRuby 3.1 and earlier and JRuby are affected. This issue is fixed in version 1.7.2."}],"id":"CVE-2026-128068","lastModified":"2026-11-13T18:17:34.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:34.577","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/commit/f776f963b9d9346271aade9cb903e793fd38e865"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128069.json b/data/2026/CVE-2026-128069.json
new file mode 100644
index 0000000000..2ffed894a7
--- /dev/null
+++ b/data/2026/CVE-2026-128069.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"rails-html-sanitizer","vendor":"rails","versions":[{"status":"affected","version":"< 1.7.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without synchronization. In a multithreaded process, concurrent sanitize calls using different tags: or attributes: options can interleave and cause one call to use the other call's allowlist. If a permissive call admits a script element or event-handler attribute, output expected to be sanitized under a stricter policy can retain it and cause cross-site scripting when rendered. Applications that are single-threaded, use one identical allowlist everywhere, or provide a separate scrubber: are not affected. This issue is fixed in version 1.7.2."}],"id":"CVE-2026-128069","lastModified":"2026-11-13T18:17:34.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:34.757","references":[{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/commit/15f764c3563d5dd9b97ad32eaa7454577ccec4b9"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/issues/228"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2"},{"source":"security-advisories@github.com","url":"https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-h7wh-q2qr-458c"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-362"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128070.json b/data/2026/CVE-2026-128070.json
new file mode 100644
index 0000000000..715de10416
--- /dev/null
+++ b/data/2026/CVE-2026-128070.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.5.0, < 4.6.4"}]},{"product":"schema","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.5.0, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128070","lastModified":"2026-11-13T18:17:35.037","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:34.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/89d3306d1976dd52ac2e73078806a3e889cbb8bd"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-mjrq-cffv-q4qc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-552"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128071.json b/data/2026/CVE-2026-128071.json
new file mode 100644
index 0000000000..f7b1000e10
--- /dev/null
+++ b/data/2026/CVE-2026-128071.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 4.6.4"}]},{"product":"nitro-server","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.20.0, < 4.0.0"},{"status":"affected","version":">= 4.2.0, < 4.6.4"}]},{"product":"vite-server","vendor":"@nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128071","lastModified":"2026-11-13T18:17:35.207","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:35.073","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/084396b101e3b4d3545e86ff80dc313496bc87c0"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-f3x9-2chm-73c8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128072.json b/data/2026/CVE-2026-128072.json
new file mode 100644
index 0000000000..52db6d674c
--- /dev/null
+++ b/data/2026/CVE-2026-128072.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 4.6.4"}]},{"product":"webpack-builder","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 4.6.4"}]},{"product":"rspack-builder","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.12.2, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128072","lastModified":"2026-11-13T18:17:36.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:35.243","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/3c9645326a2b3f5cfa09c9a935db9b1825d560e7"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/3e1c7964e6843e1c5f218867a4ccd4cd00ad9ebb"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/8c11d965dad5bfc58d4c25e796915aec045acb78"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/f8d64c9aa773a033596532365d455890da9da197"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128074.json b/data/2026/CVE-2026-128074.json
new file mode 100644
index 0000000000..0a7a925f9c
--- /dev/null
+++ b/data/2026/CVE-2026-128074.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and the experimental early-404 path use a trailing-slash regular expression whose work grows quadratically with a long run of slash characters. An unauthenticated request can synchronously occupy the Node.js event loop and delay other requests when server-side rendering uses isr, swr, or cache route rules, or when experimental.early404 is enabled. Applications without those route rules and without experimental.early404, fully prerendered applications, and client-only applications are unaffected; the impact is limited to availability. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128074","lastModified":"2026-11-13T18:17:36.803","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:36.690","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/97424dd21c59b60cc7ece28576e15069ca0fdbc4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-r9jc-w898-3fv6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128075.json b/data/2026/CVE-2026-128075.json
new file mode 100644
index 0000000000..0df5cfa6c1
--- /dev/null
+++ b/data/2026/CVE-2026-128075.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (__NUXT_DATA__) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128075","lastModified":"2026-11-13T18:17:36.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:36.843","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/8c56b71e4d0377c5c047799078db09c6b3d4fde5"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-96x6-fvhx-49hg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-209"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128076.json b/data/2026/CVE-2026-128076.json
new file mode 100644
index 0000000000..a67c870a6b
--- /dev/null
+++ b/data/2026/CVE-2026-128076.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.21.6, < 4.0.0"},{"status":"affected","version":">= 4.4.6, < 4.6.4"}]},{"product":"nitro-server","vendor":"@nuxt","versions":[{"status":"affected","version":">= 3.21.6, < 4.0.0"},{"status":"affected","version":">= 4.4.6, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128076","lastModified":"2026-11-13T18:17:37.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:37.003","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/6f1b93c643355688bc9e2d7434723f7fd3f25092"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-hf59-9xwc-2g4p"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-349"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128077.json b/data/2026/CVE-2026-128077.json
new file mode 100644
index 0000000000..c71c9f8069
--- /dev/null
+++ b/data/2026/CVE-2026-128077.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"nuxt","vendor":"nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"product":"nitro-server","vendor":"@nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admin can therefore resolve to the /admin page without route-scoped serverHandlers, server/middleware path checks, redirects, or security headers configured for /admin. API handlers in server/api and server/routes, appMiddleware, page middleware are unaffected. This issue is fixed in version 4.6.4."}],"id":"CVE-2026-128077","lastModified":"2026-11-13T18:17:37.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:37.163","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/commit/75c12c6fb4c22ec2cbde0051da24776d2dffa868"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-r99w-jh2x-3mg9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128078.json b/data/2026/CVE-2026-128078.json
new file mode 100644
index 0000000000..2b123b201a
--- /dev/null
+++ b/data/2026/CVE-2026-128078.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"glpi","vendor":"glpi-project","versions":[{"status":"affected","version":">= 9.5.0, < 10.0.27"},{"status":"affected","version":">= 11.0.0, < 11.0.9"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could access ITIL followups, tasks, or solutions generated from templates without a read-permission check on the parent ticket, problem, or change. Depending on the template configuration, this could reveal information from parent items the user could not otherwise read. This issue is fixed in versions 10.0.27 and 11.0.9."}],"id":"CVE-2026-128078","lastModified":"2026-11-13T18:17:37.453","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:37.323","references":[{"source":"security-advisories@github.com","url":"https://github.com/glpi-project/glpi/commit/6ac884ddb085ac25459c4d30706c6ba42a7f292d"},{"source":"security-advisories@github.com","url":"https://github.com/glpi-project/glpi/commit/f71c9e893588128e49b6b75bbb1ba18d9b1d2ea9"},{"source":"security-advisories@github.com","url":"https://github.com/glpi-project/glpi/releases/tag/10.0.27"},{"source":"security-advisories@github.com","url":"https://github.com/glpi-project/glpi/releases/tag/11.0.9"},{"source":"security-advisories@github.com","url":"https://github.com/glpi-project/glpi/security/advisories/GHSA-h34m-gqcf-25cp"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128079.json b/data/2026/CVE-2026-128079.json
new file mode 100644
index 0000000000..617cc805ba
--- /dev/null
+++ b/data/2026/CVE-2026-128079.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"product":"envd","vendor":"tensorchord","versions":[{"status":"affected","version":">= 0.3.38, < 1.3.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in  install.python_packages(requirements=...)  could allow access to files outside the build context. An attacker able to influence build input could cause file contents interpreted as dependency entries to appear in debug logs or build-step metadata, subject to the envd process’s permissions. Exploitation in version 1.3.5 additionally requires concurrent modification of relevant filesystem paths. This issue is fixed in version 1.3.6."}],"id":"CVE-2026-128079","lastModified":"2026-11-13T18:17:37.500","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-13T18:17:37.500","references":[{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/commit/9d575b354ce17a02ef9698b6ff0d5d14296c5734"},{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/commit/f576c92c1e6dcb9b00b60995534aeb2a83b0b407"},{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/pull/2112"},{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/pull/2119"},{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/releases/tag/v1.3.6"},{"source":"security-advisories@github.com","url":"https://github.com/tensorchord/envd/security/advisories/GHSA-jv6m-48w5-5rpr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-367"}],"source":"security-advisories@github.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-128331.json b/data/2026/CVE-2026-128331.json
index db9fdbba62..291d84ea72 100644
--- a/data/2026/CVE-2026-128331.json
+++ b/data/2026/CVE-2026-128331.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/miniflux.app/v2","product":"miniflux","vendor":"miniflux","versions":[{"lessThan":"2.3.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account."}],"id":"CVE-2026-128331","lastModified":"2026-11-13T10:18:12.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:12.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/pull/4596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/releases/tag/v2.3.5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/miniflux.app/v2","product":"miniflux","vendor":"miniflux","versions":[{"lessThan":"2.3.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit new password fields via updateSettings to lock out the owner and take over the account."}],"id":"CVE-2026-128331","lastModified":"2026-11-13T17:17:27.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128331","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:12.069685Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:12.860","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/form/settings.go#L126-L128"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/blob/v2.3.4/internal/ui/settings_update.go#L19-L98"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/commit/f654f7c7675e5c4cbd6ef5bb5858aa8d9bdf2af1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/pull/4596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/releases/tag/v2.3.5"},{"source":"disclosure@vulncheck.com","url":"https://github.com/miniflux/v2/security/advisories/GHSA-ch38-3q93-fwg8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/miniflux-before-2.3.5-password-change-without-current-password-via-settings-form"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128332.json b/data/2026/CVE-2026-128332.json
index ad5c7c8964..7e274893f7 100644
--- a/data/2026/CVE-2026-128332.json
+++ b/data/2026/CVE-2026-128332.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/knadh/listmonk","product":"listmonk","vendor":"knadh","versions":[{"lessThan":"7.0.0-beta.2","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin."}],"id":"CVE-2026-128332","lastModified":"2026-11-13T10:18:13.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.030","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/cmd/auth.go#L514-L568"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/internal/tmptokens/tmptokens.go#L13-L88"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/commit/3f62a55c13dbc679b29238e890e4b90d6d4996d8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/listmonk-6.0.0-before-7.0.0-beta.2-totp-brute-force-via-admin-login-twofa"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/knadh/listmonk","product":"listmonk","vendor":"knadh","versions":[{"lessThan":"7.0.0-beta.2","status":"affected","version":"6.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /admin/login to obtain fresh tokens, each allowing 15 more guesses, gaining sessions for 2FA-protected accounts including Super Admin."}],"id":"CVE-2026-128332","lastModified":"2026-11-13T18:17:37.663","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128332","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T18:01:10.245597Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:13.030","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/cmd/auth.go#L514-L568"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/blob/v7.0.0-beta.1/internal/tmptokens/tmptokens.go#L13-L88"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/commit/3f62a55c13dbc679b29238e890e4b90d6d4996d8"},{"source":"disclosure@vulncheck.com","url":"https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/listmonk-6.0.0-before-7.0.0-beta.2-totp-brute-force-via-admin-login-twofa"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128335.json b/data/2026/CVE-2026-128335.json
index 064cf16004..9b420b70bd 100644
--- a/data/2026/CVE-2026-128335.json
+++ b/data/2026/CVE-2026-128335.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/contao/core-bundle","product":"Contao","vendor":"Contao","versions":[{"lessThan":"5.3.54","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"5.7.17","status":"affected","version":"5.4.0-RC1","versionType":"semver"},{"lessThan":"6.0.6","status":"affected","version":"6.0.0-RC1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings."}],"id":"CVE-2026-128335","lastModified":"2026-11-13T10:18:13.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/contao/core-bundle","product":"Contao","vendor":"Contao","versions":[{"lessThan":"5.3.54","status":"affected","version":"4.6.0","versionType":"semver"},{"lessThan":"5.7.17","status":"affected","version":"5.4.0-RC1","versionType":"semver"},{"lessThan":"6.0.6","status":"affected","version":"6.0.0-RC1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings."}],"id":"CVE-2026-128335","lastModified":"2026-11-13T17:17:27.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:29:09.845342Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:13.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/blob/5.3.53/core-bundle/contao/library/Contao/User.php#L413-L446"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/7618a5757347a30168139e74c7b326e3e296059d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/7e7c821ce6c41c02ae85b3d9f8eff5039de3fe1e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/commit/843da308056402d94ae2dbb999959f9e2ce71fe1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.3.54"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/5.7.17"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/releases/tag/6.0.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/contao/contao/security/advisories/GHSA-5mg3-mv6j-57wc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/contao-before-5.3.54-5.7.17-and-6.0.6-session-invalidation-failure-on-2fa-change"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128336.json b/data/2026/CVE-2026-128336.json
index 584fc49772..1c88d67bd2 100644
--- a/data/2026/CVE-2026-128336.json
+++ b/data/2026/CVE-2026-128336.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs."}],"id":"CVE-2026-128336","lastModified":"2026-11-13T15:45:24.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:13.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L50-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs."}],"id":"CVE-2026-128336","lastModified":"2026-11-13T18:17:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128336","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:58:33.563826Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:13.757","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L50-L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1321"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128340.json b/data/2026/CVE-2026-128340.json
index 87c4c58803..54417c6993 100644
--- a/data/2026/CVE-2026-128340.json
+++ b/data/2026/CVE-2026-128340.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load()."}],"id":"CVE-2026-128340","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.373","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load()."}],"id":"CVE-2026-128340","lastModified":"2026-11-13T18:17:37.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128340","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:57:40.515144Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:14.373","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-defined-name-range"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qvh4-wwpm-ggc8"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128344.json b/data/2026/CVE-2026-128344.json
index c191a25868..cb00f9ba28 100644
--- a/data/2026/CVE-2026-128344.json
+++ b/data/2026/CVE-2026-128344.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error."}],"id":"CVE-2026-128344","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:14.977","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/anchor.js#L40-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L243-L261"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages() anchor positions makes Worksheet.getColumn allocate millions of Column objects and abort with a heap out-of-memory error."}],"id":"CVE-2026-128344","lastModified":"2026-11-13T18:17:38.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128344","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:54:29.159157Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:14.977","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/anchor.js#L40-L64"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L243-L261"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-memory-exhaustion-via-oversized-image-anchor-column"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-cqmf-h7c5-g7xx"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128348.json b/data/2026/CVE-2026-128348.json
index 90fa256fc5..17fea4a767 100644
--- a/data/2026/CVE-2026-128348.json
+++ b/data/2026/CVE-2026-128348.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook."}],"id":"CVE-2026-128348","lastModified":"2026-11-13T15:48:52.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","product":"exceljs","vendor":"exceljs","versions":[{"lessThanOrEqual":"4.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook."}],"id":"CVE-2026-128348","lastModified":"2026-11-13T18:17:38.197","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128348","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:50:31.305356Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:15.580","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs"},{"source":"disclosure@vulncheck.com","url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128424.json b/data/2026/CVE-2026-128424.json
index 546f5a95f2..8fb54c0293 100644
--- a/data/2026/CVE-2026-128424.json
+++ b/data/2026/CVE-2026-128424.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"affected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\\d` and `\\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied."}],"id":"CVE-2026-128424","lastModified":"2026-11-13T07:17:20.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-13T07:17:20.610","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-128424"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572937"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/issues/5236"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/pull/5294"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"],"defaultStatus":"affected","packageName":"kroxylicious-authorizer-acl","product":"streams for Apache Kafka 3","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\\d` and `\\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied."}],"id":"CVE-2026-128424","lastModified":"2026-11-13T18:17:38.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128424","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:45:21.268673Z","version":"2.0.3"}}]},"published":"2026-11-13T07:17:20.610","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-128424"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572937"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/issues/5236"},{"source":"secalert@redhat.com","url":"https://github.com/kroxylicious/kroxylicious/pull/5294"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128834.json b/data/2026/CVE-2026-128834.json
index 5be0ffd737..fc31858805 100644
--- a/data/2026/CVE-2026-128834.json
+++ b/data/2026/CVE-2026-128834.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-128834","lastModified":"2026-11-13T13:18:22.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}]},"published":"2026-11-13T13:18:21.997","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"unaffected","packageName":"ultimate-addons-for-gutenberg","product":"Spectra","vendor":"Brainstorm Force","versions":[{"changes":[{"at":"2.20.6","status":"unaffected"}],"lessThanOrEqual":"2.20.5","status":"affected","version":"0","versionType":"custom"}]}],"source":"audit@patchstack.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5."}],"id":"CVE-2026-128834","lastModified":"2026-11-13T17:17:28.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"audit@patchstack.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-128834","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:44:04.836510Z","version":"2.0.3"}}]},"published":"2026-11-13T13:18:21.997","references":[{"source":"audit@patchstack.com","url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-gutenberg/vulnerability/wordpress-spectra-plugin-2-20-5-broken-access-control-vulnerability?_s_id=cve"}],"sourceIdentifier":"audit@patchstack.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"audit@patchstack.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-128986.json b/data/2026/CVE-2026-128986.json
new file mode 100644
index 0000000000..b7f354adce
--- /dev/null
+++ b/data/2026/CVE-2026-128986.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Eclipse BaSyx Go Components","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.1.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"emo@eclipse.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules against the fully decoded request path, while the router routes on the raw, still encoded path. An encoded slash (`%2F`) inside a path value is a segment separator for the access check but part of the value for the router, so a request can match a narrow `ROUTE` rule while the handler returns a different, larger resource.\n\n\n\nAn authenticated caller whose rules grant READ only on parts of a resource can therefore read the whole resource. In the DPP API, a rule such as `/v1/dpps/*/elements/*`, meant to grant only passport elements, also grants the complete passport whose identifier contains `/elements/`. In the Submodel Repository, AAS Repository and AAS Environment, a rule such as `/submodels/*/submodel-elements/*/attachment`, meant to grant only file attachments, also grants the complete element whose stored idShort contains `%2F`.\n\n\n\nThe issue is fixed in Eclipse BaSyx Go Components v1.1.4."}],"id":"CVE-2026-128986","lastModified":"2026-11-13T17:17:28.133","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"emo@eclipse.org","type":"Secondary"}]},"published":"2026-11-13T17:17:28.133","references":[{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/pull/888"},{"source":"emo@eclipse.org","url":"https://github.com/eclipse-basyx/basyx-go-components/releases/tag/v1.1.4"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/582"},{"source":"emo@eclipse.org","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1389"}],"sourceIdentifier":"emo@eclipse.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-177"},{"lang":"en","value":"CWE-436"},{"lang":"en","value":"CWE-863"}],"source":"emo@eclipse.org","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129116.json b/data/2026/CVE-2026-129116.json
new file mode 100644
index 0000000000..e4d42fd4ef
--- /dev/null
+++ b/data/2026/CVE-2026-129116.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"7.0.197","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access."}],"id":"CVE-2026-129116","lastModified":"2026-11-13T17:17:28.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:28.287","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckufio.c#L8249"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/fdfe8f13159f9276d87e02bedba15946b0edda97"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-7.0.197-before-11.1.515-iksd-authentication-bypass-via-refused-certificate-login"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129117.json b/data/2026/CVE-2026-129117.json
new file mode 100644
index 0000000000..2a9e52a74d
--- /dev/null
+++ b/data/2026/CVE-2026-129117.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"8.0.200","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data."}],"id":"CVE-2026-129117","lastModified":"2026-11-13T17:17:28.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:28.447","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3916"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/0008b429e4fadc8ecfd3d7d661fd55d72e26d527"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-missing-hostname-verification-in-authentication-ssl"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-297"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129118.json b/data/2026/CVE-2026-129118.json
new file mode 100644
index 0000000000..1fac02d8a8
--- /dev/null
+++ b/data/2026/CVE-2026-129118.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"8.0.200","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections."}],"id":"CVE-2026-129118","lastModified":"2026-11-13T17:17:28.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:28.603","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ck_ssl.c#L3485"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/8c60a2bd70f5a78e77ce5d140a17e7a9cdcd5e60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-5pc4-gh6q-5h4w"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-improper-certificate-hostname-matching-via-dnsname-cmp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-297"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129119.json b/data/2026/CVE-2026-129119.json
new file mode 100644
index 0000000000..748b804c93
--- /dev/null
+++ b/data/2026/CVE-2026-129119.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"6.0.192","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files."}],"id":"CVE-2026-129119","lastModified":"2026-11-13T17:17:28.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:28.753","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129120.json b/data/2026/CVE-2026-129120.json
new file mode 100644
index 0000000000..faa02b2e8c
--- /dev/null
+++ b/data/2026/CVE-2026-129120.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"11.0.506","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution."}],"id":"CVE-2026-129120","lastModified":"2026-11-13T17:17:29.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.007","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L3452"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/49e04a5ccfa08706b1d7e51dce4059f4adce50f3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-11.0.506-before-11.1.515-receive-confirm-bypass-via-recursive-get"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129121.json b/data/2026/CVE-2026-129121.json
new file mode 100644
index 0000000000..d800394c95
--- /dev/null
+++ b/data/2026/CVE-2026-129121.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"8.0.200","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution."}],"id":"CVE-2026-129121","lastModified":"2026-11-13T17:17:29.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.157","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L7668"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/9b1809b2ce2bcec08b7285deb1b7f0bcbef6a052"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-path-traversal-via-ftp-mget-recursive"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129122.json b/data/2026/CVE-2026-129122.json
new file mode 100644
index 0000000000..5b92bb761a
--- /dev/null
+++ b/data/2026/CVE-2026-129122.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"6.0.192","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory."}],"id":"CVE-2026-129122","lastModified":"2026-11-13T17:17:29.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.313","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckctel.c#L5622"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/42cf6decb926f56d606a76262791aaf071955d25"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-buffer-overflow-via-telnet-new-environ-negotiation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129123.json b/data/2026/CVE-2026-129123.json
new file mode 100644
index 0000000000..a910fb9991
--- /dev/null
+++ b/data/2026/CVE-2026-129123.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"8.0.200","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes."}],"id":"CVE-2026-129123","lastModified":"2026-11-13T17:17:29.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.517","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcftp.c#L11161"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/39ab009a365b97632e9975e1266fa618c4bdc59f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/bec28a4d544031fa07a07aacba3df5dd1202ef69"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-8.0.200-before-11.1.515-ftp-client-buffer-overflow-via-pbsz-and-adat-replies"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129124.json b/data/2026/CVE-2026-129124.json
new file mode 100644
index 0000000000..22697a82af
--- /dev/null
+++ b/data/2026/CVE-2026-129124.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set."}],"id":"CVE-2026-129124","lastModified":"2026-11-13T17:17:29.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L1423"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/29c4bfbe12d685f93668350c24291e562029ff57"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-os-command-injection-via-remote-who-and-remote-space"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129125.json b/data/2026/CVE-2026-129125.json
new file mode 100644
index 0000000000..f320b9bb8f
--- /dev/null
+++ b/data/2026/CVE-2026-129125.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"6.0.192","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST."}],"id":"CVE-2026-129125","lastModified":"2026-11-13T17:17:29.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.827","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcpro.w#L2544"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/85ef1da670cee132ea2d8e4eb759bab310ff73c9"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-command-execution-via-remote-query"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129126.json b/data/2026/CVE-2026-129126.json
new file mode 100644
index 0000000000..cfce3c9c3c
--- /dev/null
+++ b/data/2026/CVE-2026-129126.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/OpenKermit/ckermit","product":"C-Kermit","vendor":"OpenKermit","versions":[{"lessThan":"11.1.515","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances."}],"id":"CVE-2026-129126","lastModified":"2026-11-13T17:17:29.977","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:29.977","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfns.c#L461"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/commit/37e54720779237897bc6887efac42fe138817897"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515"},{"source":"disclosure@vulncheck.com","url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-c5px-7h4c-gj8p"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/c-kermit-before-11.1.515-heap-buffer-overflow-via-putsrv-packet-decoding"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129127.json b/data/2026/CVE-2026-129127.json
new file mode 100644
index 0000000000..5a49d6ce5c
--- /dev/null
+++ b/data/2026/CVE-2026-129127.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dataease/SQLBot","product":"SQLBot","vendor":"dataease","versions":[{"lessThanOrEqual":"1.10.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes."}],"id":"CVE-2026-129127","lastModified":"2026-11-13T17:17:30.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:30.130","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dataease/SQLBot"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dataease/SQLBot/blob/96f06c7eade60ecf3e6af0313821373761d1fb85/backend/common/core/security.py#L32-L35"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dataease/SQLBot/commit/8b4097f216d0d57e7c82f12ef6b36add1f64e49e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dataease/SQLBot/issues/1432"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dataease/SQLBot/pull/1466"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sqlbot-through-1.10.3-weak-password-hashing-via-unsalted-md5"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-916"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129128.json b/data/2026/CVE-2026-129128.json
new file mode 100644
index 0000000000..9b2b82efce
--- /dev/null
+++ b/data/2026/CVE-2026-129128.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/aaif-goose/goose","product":"goose","vendor":"aaif-goose","versions":[{"lessThan":"1.53.0","status":"affected","version":"1.35.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by setting diff.external in a repository's .git/config. Attackers can ship a crafted repository that, when the victim runs goose review, executes git diff without --no-ext-diff, running commands as the user and exposing credentials and provider API keys."}],"id":"CVE-2026-129128","lastModified":"2026-11-13T17:17:30.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:30.313","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/blob/302b60806639ea9f0ae8f053f49f8bf0e88b26f4/crates/goose-cli/src/commands/review/handler.rs#L400"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/commit/3fbea00fd44f6496ee4afe2b8b2897c3c95d63e9"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/issues/12960"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/pull/12537"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/pull/13469"},{"source":"disclosure@vulncheck.com","url":"https://github.com/aaif-goose/goose/releases/tag/v1.53.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/goose-cli-1.35.0-before-1.53.0-command-execution-via-goose-review-diff-external"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129129.json b/data/2026/CVE-2026-129129.json
new file mode 100644
index 0000000000..3f58cf38db
--- /dev/null
+++ b/data/2026/CVE-2026-129129.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/beenuar/AiSOC","product":"AiSOC","vendor":"beenuar","versions":[{"lessThan":"23.3.0","status":"affected","version":"12.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next.js console rewrite routes. Attackers can send requests to /api/v1/enrichment/lookup or /api/v1/enrichment/bulk to retrieve threat-intelligence results and set force to true to consume commercial provider API quota."}],"id":"CVE-2026-129129","lastModified":"2026-11-13T17:17:30.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:30.500","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/beenuar/AiSOC/blob/4d8790e21489bffdb33bdbd1ea9ea712899efaf9/apps/web/next.config.js#L305-L310"},{"source":"disclosure@vulncheck.com","url":"https://github.com/beenuar/AiSOC/commit/3a853d16b09a4c59fb4fc3fbe20938bb4c306be7"},{"source":"disclosure@vulncheck.com","url":"https://github.com/beenuar/AiSOC/pull/1844"},{"source":"disclosure@vulncheck.com","url":"https://github.com/beenuar/AiSOC/releases/tag/v23.3.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/beenuar/AiSOC/security/advisories/GHSA-qf6m-hgwv-65f9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/aisoc-12.1.0-before-23.3.0-missing-authentication-via-enrichment-console-proxy-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129130.json b/data/2026/CVE-2026-129130.json
new file mode 100644
index 0000000000..f6382d90e8
--- /dev/null
+++ b/data/2026/CVE-2026-129130.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/agent-device","product":"agent-device","vendor":"callstack","versions":[{"lessThan":"0.21.37","status":"affected","version":"0.21.36","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account."}],"id":"CVE-2026-129130","lastModified":"2026-11-13T17:17:30.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:30.660","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/callstack/agent-device/blob/ebbaff9a6be75babdb4adcb9074d7522a2773330/packages/daemon/src/server/remote-host-input-policy.ts#L67"},{"source":"disclosure@vulncheck.com","url":"https://github.com/callstack/agent-device/commit/2deb909ec88bbbde615ec7c8f3895ef222d8ab3d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/callstack/agent-device/releases/tag/v0.21.37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/callstack/agent-device/security/advisories/GHSA-g87j-p64h-w8wc"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/agent-device-0.21.36-local-file-disclosure-via-file-navigation-in-open-command"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129131.json b/data/2026/CVE-2026-129131.json
new file mode 100644
index 0000000000..24b9ebc10c
--- /dev/null
+++ b/data/2026/CVE-2026-129131.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/gameyfin/gameyfin","product":"gameyfin","vendor":"gameyfin","versions":[{"lessThan":"2.6.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests."}],"id":"CVE-2026-129131","lastModified":"2026-11-13T17:17:30.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:30.823","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin/blob/1ec9d627228bb77cf2485e259a58d37afa98f2b7/app/src/main/kotlin/org/gameyfin/app/core/security/LiveSubscriptionSecurity.kt#L22"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin/commit/2515f1693c88bfa8145882fd85b790638738032c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin/issues/1017"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin/pull/1018"},{"source":"disclosure@vulncheck.com","url":"https://github.com/gameyfin/gameyfin/releases/tag/v2.6.2"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gameyfin-before-2.6.2-missing-authorization-in-hilla-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129132.json b/data/2026/CVE-2026-129132.json
new file mode 100644
index 0000000000..1c180f545c
--- /dev/null
+++ b/data/2026/CVE-2026-129132.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/meeting-room-booking-system/mrbs-code","product":"mrbs-code","vendor":"meeting-room-booking-system","versions":[{"lessThan":"1.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions."}],"id":"CVE-2026-129132","lastModified":"2026-11-13T17:17:31.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:31.000","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/lib/MRBS/Auth/AuthLdap.php#L749"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-r543-f38c-cq6v"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-ldap-injection-via-authldap-php-authentication-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-90"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129133.json b/data/2026/CVE-2026-129133.json
new file mode 100644
index 0000000000..2066440805
--- /dev/null
+++ b/data/2026/CVE-2026-129133.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/meeting-room-booking-system/mrbs-code","product":"mrbs-code","vendor":"meeting-room-booking-system","versions":[{"lessThan":"1.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fields that execute when privileged users open exported CSV reports, enabling data exfiltration or command execution via DDE."}],"id":"CVE-2026-129133","lastModified":"2026-11-13T17:17:31.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:31.173","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/report.php#L542-L543"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-9rvp-v4ff-wpwr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-csv-formula-injection-via-report-export"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1236"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129134.json b/data/2026/CVE-2026-129134.json
new file mode 100644
index 0000000000..d08e6d1aa7
--- /dev/null
+++ b/data/2026/CVE-2026-129134.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/meeting-room-booking-system/mrbs-code","product":"mrbs-code","vendor":"meeting-room-booking-system","versions":[{"lessThan":"1.13.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser() emails a link pointing to their host, capturing the reset key when opened to take over accounts including administrators."}],"id":"CVE-2026-129134","lastModified":"2026-11-13T17:17:31.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:31.323","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/blob/299686ed64174a66448699f5ca0fb5e0e0ea9faa/web/lib/MRBS/Auth/AuthDb.php#L613"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/commit/92f6f5610072ddb9e1b38074c410fc8be56947ed"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/releases/tag/v1.13.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/meeting-room-booking-system/mrbs-code/security/advisories/GHSA-73cv-hx7f-9v27"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mrbs-before-1.13.0-password-reset-poisoning-via-host-header-injection"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129135.json b/data/2026/CVE-2026-129135.json
new file mode 100644
index 0000000000..762a6207df
--- /dev/null
+++ b/data/2026/CVE-2026-129135.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/private-octopus/picoquic","product":"picoquic","vendor":"private-octopus","versions":[{"lessThan":"2026.11.05.3e2e3d3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control."}],"id":"CVE-2026-129135","lastModified":"2026-11-13T17:17:31.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:31.477","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic"},{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic/blob/7966b3f6a5f1dc08a844b3bfa0b22b0f8d424736/picoquic/frames.c#L5651"},{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic/commit/ef21278928771a1ace1c6764cf0e5300d61f7d94"},{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic/issues/2365"},{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic/pull/2343"},{"source":"disclosure@vulncheck.com","url":"https://github.com/private-octopus/picoquic/releases/tag/v2026.11.05.3e2e3d3"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/picoquic-before-2026.11.05-3e2e3d3-integer-overflow-via-time-stamp-frame-decoder"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129139.json b/data/2026/CVE-2026-129139.json
new file mode 100644
index 0000000000..1f2e0373f5
--- /dev/null
+++ b/data/2026/CVE-2026-129139.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"lessThanOrEqual":"903adce70309d340f7eec51ec3c80cfe3c8326c1","status":"affected","version":"b8206b97cc504b939ca6fdc46e0a8c3e816b14e9","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account."}],"id":"CVE-2026-129139","lastModified":"2026-11-13T18:17:38.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:38.447","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/user/service/user/LoginServiceImpl.java#L244-L250"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/views/user/info/edit.html#L81-L90"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-commit-b8206b9-through-903adce-predictable-zsxq-account-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1391"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129140.json b/data/2026/CVE-2026-129140.json
new file mode 100644
index 0000000000..b54106fda0
--- /dev/null
+++ b/data/2026/CVE-2026-129140.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts."}],"id":"CVE-2026-129140","lastModified":"2026-11-13T18:17:38.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:38.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/image/service/ImageServiceImpl.java#L174-L180"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-svg-image-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129141.json b/data/2026/CVE-2026-129141.json
new file mode 100644
index 0000000000..7bf0662d26
--- /dev/null
+++ b/data/2026/CVE-2026-129141.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"lessThanOrEqual":"1.0.3","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie."}],"id":"CVE-2026-129141","lastModified":"2026-11-13T18:17:38.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:38.747","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/layout/header.html#L59"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/global/SeoInjectService.java#L386-L387"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-1.0.0-through-1.0.3-stored-xss-via-json-ld-profile-description"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129142.json b/data/2026/CVE-2026-129142.json
new file mode 100644
index 0000000000..2656c0d3f5
--- /dev/null
+++ b/data/2026/CVE-2026-129142.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"lessThanOrEqual":"903adce70309d340f7eec51ec3c80cfe3c8326c1","status":"affected","version":"766c48b39037970853af56f8d86dedbf7a8a2c1c","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications."}],"id":"CVE-2026-129142","lastModified":"2026-11-13T18:17:38.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:38.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-service/src/main/java/com/github/paicoding/forum/service/notify/service/impl/NotifyMsgListener.java#L274-L288"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-ui/src/main/resources/templates/components/notice/notify-system-item.html#L18"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-commit-766c48b-through-903adce-stored-xss-via-payment-notifications"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129143.json b/data/2026/CVE-2026-129143.json
new file mode 100644
index 0000000000..8ad4829547
--- /dev/null
+++ b/data/2026/CVE-2026-129143.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"status":"affected","version":"1.0.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint that allows unauthenticated attackers to read restricted articles. Attackers can enumerate article IDs via GET /article/api/data/detail/{articleId} to retrieve full content of paid, login-only, member-only and draft articles."}],"id":"CVE-2026-129143","lastModified":"2026-11-13T18:17:39.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticleRestController.java#L87-L94"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-1.0.3-missing-authorization-via-article-detail-api-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129144.json b/data/2026/CVE-2026-129144.json
new file mode 100644
index 0000000000..4ba9a6f3e9
--- /dev/null
+++ b/data/2026/CVE-2026-129144.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/itwanger/paicoding","product":"paicoding","repo":"https://github.com/itwanger/paicoding","vendor":"itwanger","versions":[{"status":"affected","version":"1.0.3","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid."}],"id":"CVE-2026-129144","lastModified":"2026-11-13T18:17:39.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.190","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-core/src/main/java/com/github/paicoding/forum/core/util/id/IdUtil.java#L54-L61"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/blob/903adce70309d340f7eec51ec3c80cfe3c8326c1/paicoding-web/src/main/java/com/github/paicoding/forum/web/front/article/rest/ArticlePayRestController.java#L79-L90"},{"source":"disclosure@vulncheck.com","url":"https://github.com/itwanger/paicoding/issues/137"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261112/paicoding/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/paicoding-1.0.3-payment-bypass-via-guessable-codes-in-article-api-pay-callback"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-334"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129151.json b/data/2026/CVE-2026-129151.json
new file mode 100644
index 0000000000..deb3d17970
--- /dev/null
+++ b/data/2026/CVE-2026-129151.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/javahuang/SurveyKing","product":"SurveyKing","repo":"https://github.com/javahuang/SurveyKing","vendor":"javahuang","versions":[{"status":"affected","version":"1.13.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the lookup configuration, including its password, and the lookup password check is skipped when no answer is sent. Unauthenticated attackers with a public survey link can inject a % wildcard into the MyBatis LIKE condition to match all responses, then call loadProject with an answerId to read complete responses including hidden fields."}],"id":"CVE-2026-129151","lastModified":"2026-11-13T18:17:39.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.337","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/domain/mapper/ProjectViewMapper.java#L30-L33"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L1085-L1096"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L937-L959"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/issues/92"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/surveyking/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/surveyking-1.13.2-unauthenticated-survey-response-disclosure-via-result-lookup"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129152.json b/data/2026/CVE-2026-129152.json
new file mode 100644
index 0000000000..c2d7a392b6
--- /dev/null
+++ b/data/2026/CVE-2026-129152.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/javahuang/SurveyKing","product":"SurveyKing","repo":"https://github.com/javahuang/SurveyKing","vendor":"javahuang","versions":[{"lessThanOrEqual":"1.13.2","status":"affected","version":"1.12.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit responses to protected surveys and set createBy in the request body to impersonate other users, corrupting survey results."}],"id":"CVE-2026-129152","lastModified":"2026-11-13T18:17:39.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.513","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L216-L230"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L226-L236"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/issues/92"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/surveyking/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authentication-bypass-via-saveanswer-response-submission"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129153.json b/data/2026/CVE-2026-129153.json
new file mode 100644
index 0000000000..3b4424c632
--- /dev/null
+++ b/data/2026/CVE-2026-129153.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/javahuang/SurveyKing","product":"SurveyKing","repo":"https://github.com/javahuang/SurveyKing","vendor":"javahuang","versions":[{"lessThanOrEqual":"1.13.2","status":"affected","version":"1.12.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the referenced linkSurveyId belongs to the caller's own project. Authenticated attackers can point a linked option at another user's survey so that loadLinkResult and updateLinkSurveyAnswer read, rewrite, or create responses in that survey."}],"id":"CVE-2026-129153","lastModified":"2026-11-13T18:17:39.833","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.683","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L793-L830"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/SurveyServiceImpl.java#L435-L470"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/issues/92"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/surveyking/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/surveyking-1.12.0-through-1.13.2-authorization-bypass-via-linked-survey-linksurveyid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129154.json b/data/2026/CVE-2026-129154.json
new file mode 100644
index 0000000000..f035d71dff
--- /dev/null
+++ b/data/2026/CVE-2026-129154.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/javahuang/SurveyKing","product":"SurveyKing","repo":"https://github.com/javahuang/SurveyKing","vendor":"javahuang","versions":[{"lessThanOrEqual":"1.13.2","status":"affected","version":"1.13.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed."}],"id":"CVE-2026-129154","lastModified":"2026-11-13T18:17:40.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:39.890","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/blob/5de0d05b682ee34244c0b6c07be24eb6358cd8a5/server/rdbms/src/main/java/cn/surveyking/server/impl/AnswerServiceImpl.java#L728-L737"},{"source":"disclosure@vulncheck.com","url":"https://github.com/javahuang/SurveyKing/issues/92"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261107/surveyking/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/surveyking-1.13.0-through-1.13.2-stored-xss-via-response-survey-snapshot"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129155.json b/data/2026/CVE-2026-129155.json
new file mode 100644
index 0000000000..636f234785
--- /dev/null
+++ b/data/2026/CVE-2026-129155.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/liangliangyy/DjangoBlog","product":"DjangoBlog","repo":"https://github.com/liangliangyy/DjangoBlog","vendor":"liangliangyy","versions":[{"lessThanOrEqual":"2.1.0.0","status":"affected","version":"2.0.0.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators."}],"id":"CVE-2026-129155","lastModified":"2026-11-13T18:17:40.160","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:40.160","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/blob/55655f236308841e0e83f5b383b1c2056a0fb48c/blog/templatetags/blog_tags.py#L138-L141"},{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/blob/55655f236308841e0e83f5b383b1c2056a0fb48c/djangoblog/utils.py#L248-L269"},{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/issues/1030"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261101/djangoblog/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/djangoblog-2.0.0.0-through-2.1.0.0-stored-xss-via-comment-sanitizer-class-filter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129156.json b/data/2026/CVE-2026-129156.json
new file mode 100644
index 0000000000..b6d8483ea9
--- /dev/null
+++ b/data/2026/CVE-2026-129156.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/liangliangyy/DjangoBlog","product":"DjangoBlog","repo":"https://github.com/liangliangyy/DjangoBlog","vendor":"liangliangyy","versions":[{"lessThanOrEqual":"6134ed63079de676b271af31de4dd40264d17c52","status":"affected","version":"d186b1c53bac400a0c8a840f62a121d59880fe97","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers."}],"id":"CVE-2026-129156","lastModified":"2026-11-13T18:17:40.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:40.380","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/blog/templatetags/blog_tags.py#L162-L164"},{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/oauth/views.py#L102-L112"},{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/blob/6134ed63079de676b271af31de4dd40264d17c52/templates/comments/tags/comment_item_modern.html#L76"},{"source":"disclosure@vulncheck.com","url":"https://github.com/liangliangyy/DjangoBlog/issues/1030"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261101/djangoblog/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/djangoblog-commit-d186b1c-through-6134ed6-stored-xss-via-comment-reactions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129157.json b/data/2026/CVE-2026-129157.json
new file mode 100644
index 0000000000..5a2a6f17c3
--- /dev/null
+++ b/data/2026/CVE-2026-129157.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/nageoffer/ragent","product":"ragent","repo":"https://github.com/nageoffer/ragent","vendor":"nageoffer","versions":[{"lessThanOrEqual":"1.1.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details."}],"id":"CVE-2026-129157","lastModified":"2026-11-13T18:17:40.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:40.527","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/controller/RagTraceController.java#L40-L66"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/rag/service/impl/RagTraceQueryServiceImpl.java#L59-L76"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/issues/186"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/ragent/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ragent-1.0.0-through-1.1.0-missing-authorization-via-rag-traces-runs"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129158.json b/data/2026/CVE-2026-129158.json
new file mode 100644
index 0000000000..d5ac2eaf68
--- /dev/null
+++ b/data/2026/CVE-2026-129158.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/nageoffer/ragent","product":"ragent","repo":"https://github.com/nageoffer/ragent","vendor":"nageoffer","versions":[{"status":"affected","version":"1.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover."}],"id":"CVE-2026-129158","lastModified":"2026-11-13T18:17:40.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:40.690","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L187-L198"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/blob/f64de341452c8998ebf64cd264e60ccad6a31631/bootstrap/src/main/java/com/nageoffer/ai/ragent/knowledge/controller/KnowledgeDocumentController.java#L71-L82"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nageoffer/ragent/issues/187"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261104/ragent/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/ragent-1.1.0-stored-xss-via-svg-knowledge-base-document-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129160.json b/data/2026/CVE-2026-129160.json
new file mode 100644
index 0000000000..52c953bc61
--- /dev/null
+++ b/data/2026/CVE-2026-129160.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dromara/free-fs","product":"free-fs","repo":"https://github.com/dromara/free-fs","vendor":"dromara","versions":[{"lessThanOrEqual":"2.3.1","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes."}],"id":"CVE-2026-129160","lastModified":"2026-11-13T18:17:40.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:40.853","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/service/impl/FileShareServiceImpl.java#L93-L99"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/issues/28"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/free-fs/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-sql-injection-via-orderby-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129161.json b/data/2026/CVE-2026-129161.json
new file mode 100644
index 0000000000..d50bac79c4
--- /dev/null
+++ b/data/2026/CVE-2026-129161.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dromara/free-fs","product":"free-fs","repo":"https://github.com/dromara/free-fs","vendor":"dromara","versions":[{"lessThanOrEqual":"2.3.1","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account."}],"id":"CVE-2026-129161","lastModified":"2026-11-13T18:17:41.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.007","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-system/src/main/java/com/xddcodec/fs/system/service/impl/SysUserServiceImpl.java#L277-L294"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/issues/28"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/free-fs/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-password-reset-code-brute-force-account-takeover"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129162.json b/data/2026/CVE-2026-129162.json
new file mode 100644
index 0000000000..d4d193f50b
--- /dev/null
+++ b/data/2026/CVE-2026-129162.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dromara/free-fs","product":"free-fs","repo":"https://github.com/dromara/free-fs","vendor":"dromara","versions":[{"lessThanOrEqual":"2.3.1","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files."}],"id":"CVE-2026-129162","lastModified":"2026-11-13T18:17:41.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.150","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-admin/src/main/java/com/xddcodec/fs/web/WebMvcConfig.java#L50-L84"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/controller/FileStreamController.java#L52-L77"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/issues/28"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/free-fs/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-missing-authentication-via-file-stream-preview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129163.json b/data/2026/CVE-2026-129163.json
new file mode 100644
index 0000000000..48198d603e
--- /dev/null
+++ b/data/2026/CVE-2026-129163.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dromara/free-fs","product":"free-fs","repo":"https://github.com/dromara/free-fs","vendor":"dromara","versions":[{"lessThanOrEqual":"2.3.1","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account."}],"id":"CVE-2026-129163","lastModified":"2026-11-13T18:17:41.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.303","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/controller/FileStreamController.java#L209-L237"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/issues/28"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/free-fs/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-stored-xss-via-file-preview-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129164.json b/data/2026/CVE-2026-129164.json
new file mode 100644
index 0000000000..6f954d2e87
--- /dev/null
+++ b/data/2026/CVE-2026-129164.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/dromara/free-fs","product":"free-fs","repo":"https://github.com/dromara/free-fs","vendor":"dromara","versions":[{"lessThanOrEqual":"2.3.1","status":"affected","version":"2.0.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares."}],"id":"CVE-2026-129164","lastModified":"2026-11-13T18:17:41.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.447","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/service/impl/FileShareServiceImpl.java#L252-L268"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/service/impl/FileShareServiceImpl.java#L330-L333"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/blob/f8f4ff2a0b0af8fcd5cbecbf99a4afb7d0b7c020/fs-modules/fs-file/src/main/java/com/xddcodec/fs/file/service/impl/FileShareServiceImpl.java#L390-L397"},{"source":"disclosure@vulncheck.com","url":"https://github.com/dromara/free-fs/issues/28"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/free-fs/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/dromara-free-fs-2.0.1-through-2.3.1-share-code-and-permission-scope-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129165.json b/data/2026/CVE-2026-129165.json
new file mode 100644
index 0000000000..8c7d68c8f1
--- /dev/null
+++ b/data/2026/CVE-2026-129165.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/amidaware/tacticalrmm","product":"Tactical RMM","repo":"https://github.com/amidaware/tacticalrmm","vendor":"AmidaWare","versions":[{"lessThanOrEqual":"1.6.1","status":"affected","version":"0.17.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permission can read the Django SECRET_KEY, reused as the NATS password, and publish runscript commands to every managed agent."}],"id":"CVE-2026-129165","lastModified":"2026-11-13T18:17:41.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.600","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/utils.py#L110-L117"},{"source":"disclosure@vulncheck.com","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/ee/reporting/views.py#L202-L245"},{"source":"disclosure@vulncheck.com","url":"https://github.com/amidaware/tacticalrmm/blob/086e2d9714b1716796722c7e0c19a1ebe08a39f2/api/tacticalrmm/tacticalrmm/utils.py#L227-L236"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261028/tacticalrmm/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tactical-rmm-0.17.0-through-1.6.1-arbitrary-file-read-via-report-preview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129166.json b/data/2026/CVE-2026-129166.json
new file mode 100644
index 0000000000..63d760d27b
--- /dev/null
+++ b/data/2026/CVE-2026-129166.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/keephq/keep","product":"Keep","repo":"https://github.com/keephq/keep","vendor":"keephq","versions":[{"lessThanOrEqual":"0.55.0","status":"affected","version":"0.34.10","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes."}],"id":"CVE-2026-129166","lastModified":"2026-11-13T18:17:41.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.753","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/cel_ast_converter.py#L278-L290"},{"source":"disclosure@vulncheck.com","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/postgresql.py#L22-L26"},{"source":"disclosure@vulncheck.com","url":"https://github.com/keephq/keep/blob/ab394bf49813b92377bbce4332d4f5cad1563a9c/keep/api/core/cel_to_sql/sql_providers/sqlite.py#L16-L18"},{"source":"disclosure@vulncheck.com","url":"https://github.com/keephq/keep/issues/6902"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261030/keephq_keep/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/keep-0.34.10-through-0.55.0-blind-sql-injection-via-cel-bracket-indexed-json-keys"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129167.json b/data/2026/CVE-2026-129167.json
new file mode 100644
index 0000000000..37b4a38f2d
--- /dev/null
+++ b/data/2026/CVE-2026-129167.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/haiwen/seadoc-converter","product":"SeaDoc","repo":"https://github.com/haiwen/seadoc-converter","vendor":"Seafile","versions":[{"lessThan":"2.0.11","status":"affected","version":"2.0.4","versionType":"semver"},{"lessThan":"3.0.8","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request."}],"id":"CVE-2026-129167","lastModified":"2026-11-13T18:17:41.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:41.910","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seadoc-converter/blob/bb6cf0fb9ebc6bb05c9161acbfd6289737ec2cd6/seadoc_converter/server/apis.py#L26-L42"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seadoc-converter/blob/bb6cf0fb9ebc6bb05c9161acbfd6289737ec2cd6/seadoc_converter/server/apis.py#L360-L395"},{"source":"disclosure@vulncheck.com","url":"https://github.com/haiwen/seadoc-converter/commit/cb43162e8bc2991a2900c8acf85090358a30e516"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261024/seafile/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/seadoc-converter-2.0.4-before-2.0.11-and-3.0.0-before-3.0.8-path-traversal-rce-via-confluence-to-wiki"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129168.json b/data/2026/CVE-2026-129168.json
new file mode 100644
index 0000000000..1c80147f03
--- /dev/null
+++ b/data/2026/CVE-2026-129168.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jinnrry/pmail","product":"PMail","repo":"https://github.com/Jinnrry/PMail","vendor":"Jinnrry","versions":[{"lessThanOrEqual":"2.9.8","status":"affected","version":"2.9.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's."}],"id":"CVE-2026-129168","lastModified":"2026-11-13T18:17:42.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:42.057","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/controllers/attachments.go#L13-L30"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/dto/parsemail/email.go#L335-L351"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/services/detail/detail.go#L49-L58"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/issues/371"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261027/pmail/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pmail-2.9.1-through-2.9.8-stored-xss-via-inline-html-attachments"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129169.json b/data/2026/CVE-2026-129169.json
new file mode 100644
index 0000000000..00e4d7cca9
--- /dev/null
+++ b/data/2026/CVE-2026-129169.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jinnrry/pmail","product":"PMail","repo":"https://github.com/Jinnrry/PMail","vendor":"Jinnrry","versions":[{"lessThanOrEqual":"2.9.8","status":"affected","version":"2.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover."}],"id":"CVE-2026-129169","lastModified":"2026-11-13T18:17:42.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:42.210","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/fe/src/views/EmailDetailView.vue#L52"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/controllers/email/send.go#L144-L184"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/services/detail/detail.go#L20-L29"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Jinnrry/PMail/issues/371"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261027/pmail/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pmail-2.5.0-through-2.9.8-stored-xss-via-api-email-send-html-body"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129170.json b/data/2026/CVE-2026-129170.json
new file mode 100644
index 0000000000..bd8691e2ea
--- /dev/null
+++ b/data/2026/CVE-2026-129170.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/vastsa/filecodebox","product":"FileCodeBox","repo":"https://github.com/vastsa/FileCodeBox","vendor":"vastsa","versions":[{"lessThanOrEqual":"2.8.4","status":"affected","version":"2.2.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which returns unsanitized text when the marked parser throws. Unauthenticated attackers can share text with thousands of nested blockquote markers followed by HTML payloads, executing script that steals the admin token from localStorage."}],"id":"CVE-2026-129170","lastModified":"2026-11-13T18:17:42.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:42.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/vastsa/FileCodeBox/issues/557"},{"source":"disclosure@vulncheck.com","url":"https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/components/common/ContentPreviewModal.vue#L45-L50"},{"source":"disclosure@vulncheck.com","url":"https://github.com/vastsa/FileCodeBoxFronted/blob/bcc1dbda06b772d6f4afbcc12c6f12e60bbbc7da/src/utils/content-preview.ts#L43-L57"},{"source":"disclosure@vulncheck.com","url":"https://github.com/vastsa/FileCodeBoxFronted/commit/4c40406d366af1583a3ba2327366b7a62d765537"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261027/filecodebox/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/filecodebox-2.2.1-through-2.8.4-stored-xss-via-markdown-preview-parser-error"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129171.json b/data/2026/CVE-2026-129171.json
new file mode 100644
index 0000000000..ad691e49da
--- /dev/null
+++ b/data/2026/CVE-2026-129171.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/likaia/nginxpulse","product":"NginxPulse","repo":"https://github.com/likaia/nginxpulse","vendor":"likaia","versions":[{"lessThan":"1.6.26","status":"affected","version":"1.5.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions."}],"id":"CVE-2026-129171","lastModified":"2026-11-13T18:17:42.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:42.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/likaia/nginxpulse/blob/0d41264ae441ddfcb595551f2e2f374f707dae22/internal/analytics/overall_stats.go#L219-L224"},{"source":"disclosure@vulncheck.com","url":"https://github.com/likaia/nginxpulse/blob/0d41264ae441ddfcb595551f2e2f374f707dae22/internal/analytics/stats.go#L217-L221"},{"source":"disclosure@vulncheck.com","url":"https://github.com/likaia/nginxpulse/commit/f9416bea3be892a394cd24a6d4a2afbd8397e926"},{"source":"disclosure@vulncheck.com","url":"https://github.com/likaia/nginxpulse/issues/103"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261030/nginxpulse/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nginxpulse-1.5.0-before-1.6.26-sql-injection-via-api-stats-type"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129172.json b/data/2026/CVE-2026-129172.json
new file mode 100644
index 0000000000..32328b88a0
--- /dev/null
+++ b/data/2026/CVE-2026-129172.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/tianma-if/edgeever","product":"EdgeEver","repo":"https://github.com/tianma-if/edgeever","vendor":"tianma-if","versions":[{"lessThan":"2.13.0","status":"affected","version":"1.9.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /api/v1/restores/json/resources/:id, which accepts a resource kind of image paired with a text/html MIME type without checking consistency. Authenticated members can share the note and send the public blob link to a victim, whose browser executes the script to mint a non-expiring API token granting read and write access to the victim's notes."}],"id":"CVE-2026-129172","lastModified":"2026-11-13T18:17:42.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:42.697","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/backup-routes.ts#L487-L550"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tianma-if/edgeever/blob/eeaab088f41d0417fbce2266f58ff4adde7f5d76/apps/api/src/share-routes.ts#L77-L80"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tianma-if/edgeever/commit/dc5a55a1c26d6add0e28d95dc0b282c611692e34"},{"source":"disclosure@vulncheck.com","url":"https://github.com/tianma-if/edgeever/issues/701"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261028/edgeever/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/edgeever-1.9.0-before-2.13.0-stored-xss-via-backup-restore-and-public-shares"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-15425.json b/data/2026/CVE-2026-15425.json
index 480358a13a..dfa00e32f7 100644
--- a/data/2026/CVE-2026-15425.json
+++ b/data/2026/CVE-2026-15425.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI","vendor":"yoast","versions":[{"lessThanOrEqual":"28.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL."}],"id":"CVE-2026-15425","lastModified":"2026-07-27T20:25:13.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-15425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-27T14:36:35.466494Z","version":"2.0.3"}}]},"published":"2026-07-25T07:17:09.897","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L898"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L900"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L898"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L900"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0&new_path=%2Fwordpress-seo/tags/28.1"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Yoast SEO – Advanced SEO with real-time guidance and built-in AI","vendor":"yoast","versions":[{"lessThanOrEqual":"28.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL."}],"id":"CVE-2026-15425","lastModified":"2026-11-13T17:17:31.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-15425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-27T14:36:35.466494Z","version":"2.0.3"}}]},"published":"2026-07-25T07:17:09.897","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L898"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/27.6/admin/class-bulk-editor-list-table.php#L900"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L898"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wordpress-seo/tags/28.0/admin/class-bulk-editor-list-table.php#L900"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3598937/wordpress-seo/trunk/admin/class-bulk-editor-list-table.php"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?old_path=%2Fwordpress-seo/tags/28.0&new_path=%2Fwordpress-seo/tags/28.1"},{"source":"security@wordfence.com","url":"https://research.cleantalk.org/cve-2026-15425"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2fa1b7-a5af-4ea6-9bee-19a6cdfd7701?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-24799.json b/data/2026/CVE-2026-24799.json
index 9fb1b8f09c..6612237439 100644
--- a/data/2026/CVE-2026-24799.json
+++ b/data/2026/CVE-2026-24799.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://github.com/davisking/dlib","defaultStatus":"affected","modules":["dlib/external/zlib"],"product":"dlib","programFiles":["inflate.c"],"vendor":"davisking","versions":[{"lessThan":"v19.24.9","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects dlib: before v19.24.9."},{"lang":"es","value":"Escritura fuera de límites, Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en davisking dlib (módulos dlib/external/zlib). Esta vulnerabilidad está asociada con los archivos de programa inflate.C.\n\nEste problema afecta a dlib: antes de la v19.24.9."}],"id":"CVE-2026-24799","lastModified":"2026-11-13T16:07:36.783","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-24799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-27T15:29:05.640071Z","version":"2.0.3"}}]},"published":"2026-01-27T09:15:49.787","references":[{"source":"cve_disclosure@tech.gov.sg","url":"https://github.com/davisking/dlib/pull/3063"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-787"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://github.com/davisking/dlib","defaultStatus":"affected","modules":["dlib/external/zlib"],"product":"dlib","programFiles":["inflate.c"],"vendor":"davisking","versions":[{"lessThan":"v19.24.9","status":"affected","version":"0","versionType":"git"}]}],"source":"cve_disclosure@tech.gov.sg"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dlib:dlib:*:*:*:*:*:*:*:*","matchCriteriaId":"A4CC17A6-7E03-46DD-9633-CA94439A5CFF","versionEndExcluding":"19.24.9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C.\n\nThis issue affects dlib: before v19.24.9."},{"lang":"es","value":"Escritura fuera de límites, Copia de búfer sin verificar el tamaño de la entrada ('Desbordamiento de búfer clásico') vulnerabilidad en davisking dlib (módulos dlib/external/zlib). Esta vulnerabilidad está asociada con los archivos de programa inflate.C.\n\nEste problema afecta a dlib: antes de la v19.24.9."}],"id":"CVE-2026-24799","lastModified":"2026-11-13T17:01:49.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-24799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-27T15:29:05.640071Z","version":"2.0.3"}}]},"published":"2026-01-27T09:15:49.787","references":[{"source":"cve_disclosure@tech.gov.sg","tags":["Issue Tracking","Patch"],"url":"https://github.com/davisking/dlib/pull/3063"}],"sourceIdentifier":"cve_disclosure@tech.gov.sg","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"},{"lang":"en","value":"CWE-787"}],"source":"cve_disclosure@tech.gov.sg","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-26248.json b/data/2026/CVE-2026-26248.json
index e8ab7bbadd..d5fd1ae822 100644
--- a/data/2026/CVE-2026-26248.json
+++ b/data/2026/CVE-2026-26248.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.8","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThanOrEqual":"4.2.8","status":"affected","version":"4.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox PaaS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests."}],"id":"CVE-2026-26248","lastModified":"2026-11-12T19:14:29.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}]},"published":"2026-11-10T20:19:11.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-142"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThanOrEqual":"4.4.8","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThanOrEqual":"4.2.8","status":"affected","version":"4.2.1","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox Cloud","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]},{"cpes":["cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"FortiSandbox PaaS","vendor":"Fortinet","versions":[{"lessThanOrEqual":"5.0.5","status":"affected","version":"5.0.4","versionType":"semver"}]}],"source":"psirt@fortinet.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to perform an XSS attack via social engineering and crafted HTTP requests."}],"id":"CVE-2026-26248","lastModified":"2026-11-13T17:17:31.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"psirt@fortinet.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-26248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:41:54.444469Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:11.280","references":[{"source":"psirt@fortinet.com","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-142"}],"sourceIdentifier":"psirt@fortinet.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@fortinet.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-42784.json b/data/2026/CVE-2026-42784.json
index c067a0e2ad..49017da8c1 100644
--- a/data/2026/CVE-2026-42784.json
+++ b/data/2026/CVE-2026-42784.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.34-1.el9ap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.10.2.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-sequoia-sqv","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.3.0.2-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-sequoia-sq","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.4.0.1-2.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.6.0-6.el10_0.7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.10.2.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791460851","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rust-podman-sequoia-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0.3.2-4.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.10.3-0.3.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-monitor-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-operator-bundle","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-podvm-payload-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rust-podman-sequoia","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"trustee","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"trustee-guest-components","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"trustee-guest-components","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"kata-containers","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:2"],"defaultStatus":"affected","packageName":"rhtpa/rhtpa-trustification-service-rhel9","product":"Red Hat Trusted Profile Analyzer","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:3"],"defaultStatus":"unaffected","packageName":"rhtpa/rhtpa-rhel10","product":"Red Hat Trusted Profile Analyzer","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity."}],"id":"CVE-2026-42784","lastModified":"2026-11-13T00:20:17.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-18T18:12:18.297877Z","version":"2.0.3"}}]},"published":"2026-09-16T17:17:18.380","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:34160"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:42902"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76733"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76734"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76735"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76737"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79357"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94791"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-42784"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.34-1.el9ap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.10.2.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-sequoia-sqv","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.3.0.2-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"rust-sequoia-sq","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.4.0.1-2.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.6.0-6.el10_0.7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.10.2.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pysequoia","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pysequoia","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cost_management_on_premise:1::el10"],"defaultStatus":"affected","packageName":"costmanagement/costmanagement-ui-rhel10","product":"Red Hat Cost Management On-Premise 1","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791460851","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rust-podman-sequoia-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0.3.2-4.hum1","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"rust-rpm-sequoia-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.10.3-0.3.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-monitor-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-operator-bundle","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-podvm-builder-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-podvm-payload-rhel9","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:confidential_compute_attestation:1"],"defaultStatus":"unaffected","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","product":"Confidential Compute Attestation","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"rust-podman-sequoia","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"trustee","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"trustee-guest-components","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"trustee-guest-components","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"kata-containers","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:2"],"defaultStatus":"affected","packageName":"rhtpa/rhtpa-trustification-service-rhel9","product":"Red Hat Trusted Profile Analyzer","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:trusted_profile_analyzer:3"],"defaultStatus":"unaffected","packageName":"rhtpa/rhtpa-rhel10","product":"Red Hat Trusted Profile Analyzer","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity."}],"id":"CVE-2026-42784","lastModified":"2026-11-13T17:17:31.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-42784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-18T18:12:18.297877Z","version":"2.0.3"}}]},"published":"2026-09-16T17:17:18.380","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:34160"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:42902"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76733"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76734"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76735"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:76737"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:79357"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:94791"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98248"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-42784"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-4391.json b/data/2026/CVE-2026-4391.json
index 5fbf44c731..49262826b8 100644
--- a/data/2026/CVE-2026-4391.json
+++ b/data/2026/CVE-2026-4391.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:teamspeak_3_server:teamspeak_3_server:*:*:*:*:*:*:*:*"],"modules":["ECC Key Parser"],"product":"TeamSpeak 3 Server","vendor":"n/a","versions":[{"status":"affected","version":"3.13.0"},{"status":"affected","version":"3.13.1"},{"status":"affected","version":"3.13.2"},{"status":"affected","version":"3.13.3"},{"status":"affected","version":"3.13.4"},{"status":"affected","version":"3.13.5"},{"status":"affected","version":"3.13.6"},{"status":"affected","version":"3.13.7"},{"status":"unaffected","version":"3.13.8"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.7. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.8 is able to resolve this issue. It is suggested to upgrade the affected component."}],"id":"CVE-2026-4391","lastModified":"2026-06-17T10:56:30.703","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4391","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-27T18:45:12.171333Z","version":"2.0.3"}}]},"published":"2026-05-27T18:16:28.607","references":[{"source":"cna@vuldb.com","url":"https://files.teamspeak-services.com/docs/security/TS-SA-2026-001.html"},{"source":"cna@vuldb.com","url":"https://modzero.com/en/advisories/mz-26-01-teamspeak/"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/366315"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/366315/cti"},{"source":"cna@vuldb.com","url":"https://www.teamspeak.com/en/downloads/#server"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-122"}],"source":"cna@vuldb.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:teamspeak_3_server:teamspeak_3_server:*:*:*:*:*:*:*:*"],"modules":["ECC Key Parser"],"product":"TeamSpeak 3 Server","vendor":"n/a","versions":[{"status":"affected","version":"3.13.0"},{"status":"affected","version":"3.13.1"},{"status":"affected","version":"3.13.2"},{"status":"affected","version":"3.13.3"},{"status":"affected","version":"3.13.4"},{"status":"affected","version":"3.13.5"},{"status":"affected","version":"3.13.6"},{"status":"affected","version":"3.13.7"},{"status":"affected","version":"3.13.8"},{"status":"unaffected","version":"3.13.9"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in TeamSpeak 3 Server up to 3.13.8. This vulnerability affects unknown code of the component ECC Key Parser. Such manipulation leads to heap-based buffer overflow. The attack may be launched remotely. Upgrading to version 3.13.9 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: \"We have just released TeamSpeak 3 Server 3.13.9 to address a remaining variant of CVE-2026-4391, affecting ECC key parsing during the connection handshake. The original fix released with 3.13.8 did not cover this additional variant, which could allow an unauthenticated remote attacker to crash the server using specially crafted input.\""}],"id":"CVE-2026-4391","lastModified":"2026-11-13T18:17:43.060","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4391","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-27T18:45:12.171333Z","version":"2.0.3"}}]},"published":"2026-05-27T18:16:28.607","references":[{"source":"cna@vuldb.com","url":"https://community.teamspeak.com/t/teamspeak-3-server-3-13-9-security-update/65759"},{"source":"cna@vuldb.com","url":"https://files.teamspeak-services.com/docs/security/TS-SA-2026-001.html"},{"source":"cna@vuldb.com","url":"https://modzero.com/en/advisories/mz-26-01-teamspeak/"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-4391"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/366315"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/366315/cti"},{"source":"cna@vuldb.com","url":"https://www.teamspeak.com/en/downloads/#server"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-122"}],"source":"cna@vuldb.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-46677.json b/data/2026/CVE-2026-46677.json
index a4895f76a0..8642622b03 100644
--- a/data/2026/CVE-2026-46677.json
+++ b/data/2026/CVE-2026-46677.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-46677","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-12T20:18:39.550","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1344"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-130"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.4"},{"status":"affected","version":"< 1.5.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a remote returnedRecordCount value and the fixed local fileData[] array capacity in BACNET_ATOMIC_READ_FILE_DATA. The ACK decode path preserves the remote RecordCount, discards storage for excess records without truncating that count, and a downstream sink later iterates over the original RecordCount and indexes fileData[i] out of bounds. This issue has been patched in versions 1.4.4 and 1.5.1."}],"id":"CVE-2026-46677","lastModified":"2026-11-13T17:17:32.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-46677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:43.238155Z","version":"2.0.3"}}]},"published":"2026-11-12T20:18:39.550","references":[{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/pull/1344"},{"source":"security-advisories@github.com","url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-rv5h-cxwq-q3mh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-130"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-53995.json b/data/2026/CVE-2026-53995.json
index 0f84d152d0..7546f8d8c0 100644
--- a/data/2026/CVE-2026-53995.json
+++ b/data/2026/CVE-2026-53995.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageURL":"pkg:github/mlflow/mlflow","product":"mlflow","repo":"https://github.com/mlflow/mlflow","vendor":"mlflow","versions":[{"lessThanOrEqual":"3.17.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected."}],"id":"CVE-2026-53995","lastModified":"2026-11-02T17:17:44.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-53995","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-19T21:36:41.493578Z","version":"2.0.3"}}]},"published":"2026-10-19T22:17:11.013","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/commit/d64cc8b673f71d29d93a7845fc179946ad56a881"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/pull/26842"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unknown","packageURL":"pkg:github/mlflow/mlflow","product":"mlflow","repo":"https://github.com/mlflow/mlflow","vendor":"mlflow","versions":[{"lessThan":"3.18.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected."}],"id":"CVE-2026-53995","lastModified":"2026-11-13T18:17:43.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-53995","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-19T21:36:41.493578Z","version":"2.0.3"}}]},"published":"2026-10-19T22:17:11.013","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/commit/d64cc8b673f71d29d93a7845fc179946ad56a881"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/pull/26842"},{"source":"disclosure@vulncheck.com","url":"https://github.com/mlflow/mlflow/releases/tag/v3.18.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-55309.json b/data/2026/CVE-2026-55309.json
index 0a0156583c..eeff0733a7 100644
--- a/data/2026/CVE-2026-55309.json
+++ b/data/2026/CVE-2026-55309.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55309","lastModified":"2026-11-13T05:18:40.077","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:12.797","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-55309","lastModified":"2026-11-13T17:17:32.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-55309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:02:16.545013Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:12.797","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-56926.json b/data/2026/CVE-2026-56926.json
index 9d4fcb4185..63c6e4e901 100644
--- a/data/2026/CVE-2026-56926.json
+++ b/data/2026/CVE-2026-56926.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56926","lastModified":"2026-11-13T05:18:42.237","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56926","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.463","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device reboot due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-56926","lastModified":"2026-11-13T17:17:32.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-56926","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:55.531427Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:15.463","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-57005.json b/data/2026/CVE-2026-57005.json
index bca9981fee..207c423877 100644
--- a/data/2026/CVE-2026-57005.json
+++ b/data/2026/CVE-2026-57005.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57005","lastModified":"2026-11-13T05:18:44.397","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57005","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.750","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. This could lead to remote escalation of privilege with execution privileges needed. User interaction is for exploitation."}],"id":"CVE-2026-57005","lastModified":"2026-11-13T17:17:32.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-57005","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:17.626247Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:17.750","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-441"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58505.json b/data/2026/CVE-2026-58505.json
index 75c1565eee..f33ad1ffaa 100644
--- a/data/2026/CVE-2026-58505.json
+++ b/data/2026/CVE-2026-58505.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"geojson-vt","vendor":"maplibre","versions":[{"status":"affected","version":"< 6.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1."}],"id":"CVE-2026-58505","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:42.580","references":[{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/pull/156"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"geojson-vt","vendor":"maplibre","versions":[{"status":"affected","version":"< 6.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1."}],"id":"CVE-2026-58505","lastModified":"2026-11-13T18:17:43.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58505","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:31:05.226138Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:42.580","references":[{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/pull/156"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-674"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58740.json b/data/2026/CVE-2026-58740.json
index 8454ffc1c5..c8e9e08d90 100644
--- a/data/2026/CVE-2026-58740.json
+++ b/data/2026/CVE-2026-58740.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58740","lastModified":"2026-11-13T05:18:47.280","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.423","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58740","lastModified":"2026-11-13T17:17:32.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:00:48.104506Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:24.423","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-58805.json b/data/2026/CVE-2026-58805.json
index edcb6c51e5..39d5f1f56d 100644
--- a/data/2026/CVE-2026-58805.json
+++ b/data/2026/CVE-2026-58805.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58805","lastModified":"2026-11-13T05:18:49.290","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.487","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-58805","lastModified":"2026-11-13T17:17:32.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-58805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:49.744288Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:27.487","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59192.json b/data/2026/CVE-2026-59192.json
index 65b5f8ea2f..88b15d71d8 100644
--- a/data/2026/CVE-2026-59192.json
+++ b/data/2026/CVE-2026-59192.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"twig-view","vendor":"cakephp","versions":[{"status":"affected","version":"< 1.3.3"},{"status":"affected","version":">= 2.0.0, < 2.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2."}],"id":"CVE-2026-59192","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:49.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/pull/119"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/pull/120"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/1.3.3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/2.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/security/advisories/GHSA-48qj-5wxh-m8hc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"twig-view","vendor":"cakephp","versions":[{"status":"affected","version":"< 1.3.3"},{"status":"affected","version":">= 2.0.0, < 2.1.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2."}],"id":"CVE-2026-59192","lastModified":"2026-11-13T17:17:33.030","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:06:54.424216Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:49.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/pull/119"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/pull/120"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/1.3.3"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/releases/tag/2.1.2"},{"source":"security-advisories@github.com","url":"https://github.com/cakephp/twig-view/security/advisories/GHSA-48qj-5wxh-m8hc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-59630.json b/data/2026/CVE-2026-59630.json
index 30ce6c5118..730f3f6dba 100644
--- a/data/2026/CVE-2026-59630.json
+++ b/data/2026/CVE-2026-59630.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59630","lastModified":"2026-11-13T05:18:52.027","metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T20:19:32.640","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-59630","lastModified":"2026-11-13T17:17:33.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-59630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T05:01:47.573309Z","version":"2.0.3"}}]},"published":"2026-11-10T20:19:32.640","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61417.json b/data/2026/CVE-2026-61417.json
index 90825f4b5b..d30f74ae2b 100644
--- a/data/2026/CVE-2026-61417.json
+++ b/data/2026/CVE-2026-61417.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-61417","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T10:18:15.747","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SmartFabric OS10 Software","vendor":"Dell","versions":[{"lessThan":"10.6.0.10","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service."}],"id":"CVE-2026-61417","lastModified":"2026-11-13T18:17:43.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61417","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:48:31.533713Z","version":"2.0.3"}}]},"published":"2026-11-13T10:18:15.747","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000530043/dsa-2026-438-security-update-for-dell-networking-os10-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-61810.json b/data/2026/CVE-2026-61810.json
index c0b521ec34..116265bbaf 100644
--- a/data/2026/CVE-2026-61810.json
+++ b/data/2026/CVE-2026-61810.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"libspdm","vendor":"DMTF","versions":[{"status":"affected","version":"= 1.4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libspdm is a sample implementation that follows the DMTF SPDM specifications. In version 1.4.0, both the FINISH request (Table 80) and the FINISH_RSP response (Table 81) gained two new fields, OpaqueDataLength and OpaqueData, placed before the trailing signed/authenticated field. The transcript definitions used to compute and verify the FINISH signature, the FINISH HMAC (RequesterVerifyData), and the FINISH_RSP HMAC (ResponderVerifyData) were not updated and still terminate with a step of the form. Per DSP0274, the \"SPDM Header Fields\" are only the four header bytes (SPDMVersion, RequestResponseCode, Param1, Param2). A literal reading therefore excludes OpaqueDataLength and OpaqueData, even though those fields are transmitted before the trailing signature/HMAC field. Because the signature/HMAC must cover every field transmitted before it to \"protect the entire handshake against manipulation by an active attacker,\" an active attacker could otherwise modify the opaque data in flight without invalidating the signature or HMAC. This issue has been patched in version 1.4.1."}],"id":"CVE-2026-61810","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:49.680","references":[{"source":"security-advisories@github.com","url":"https://github.com/DMTF/libspdm/issues/3633"},{"source":"security-advisories@github.com","url":"https://github.com/DMTF/libspdm/security/advisories/GHSA-chjj-xvqx-c8w4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-325"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"libspdm","vendor":"DMTF","versions":[{"status":"affected","version":"= 1.4.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libspdm is a sample implementation that follows the DMTF SPDM specifications. In version 1.4.0, both the FINISH request (Table 80) and the FINISH_RSP response (Table 81) gained two new fields, OpaqueDataLength and OpaqueData, placed before the trailing signed/authenticated field. The transcript definitions used to compute and verify the FINISH signature, the FINISH HMAC (RequesterVerifyData), and the FINISH_RSP HMAC (ResponderVerifyData) were not updated and still terminate with a step of the form. Per DSP0274, the \"SPDM Header Fields\" are only the four header bytes (SPDMVersion, RequestResponseCode, Param1, Param2). A literal reading therefore excludes OpaqueDataLength and OpaqueData, even though those fields are transmitted before the trailing signature/HMAC field. Because the signature/HMAC must cover every field transmitted before it to \"protect the entire handshake against manipulation by an active attacker,\" an active attacker could otherwise modify the opaque data in flight without invalidating the signature or HMAC. This issue has been patched in version 1.4.1."}],"id":"CVE-2026-61810","lastModified":"2026-11-13T17:17:33.310","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-61810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:04:51.007611Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:49.680","references":[{"source":"security-advisories@github.com","url":"https://github.com/DMTF/libspdm/issues/3633"},{"source":"security-advisories@github.com","url":"https://github.com/DMTF/libspdm/security/advisories/GHSA-chjj-xvqx-c8w4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-325"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63146.json b/data/2026/CVE-2026-63146.json
index a0f612338f..deef580517 100644
--- a/data/2026/CVE-2026-63146.json
+++ b/data/2026/CVE-2026-63146.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system."}],"id":"CVE-2026-63146","lastModified":"2026-10-17T02:17:20.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63146","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:41:45.522342Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.210","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-php-code-injection-via-config-inc-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system."}],"id":"CVE-2026-63146","lastModified":"2026-11-13T18:17:43.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63146","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:41:45.522342Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.210","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63146-unauthenticated-rce-at-installation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-php-code-injection-via-config-inc-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63147.json b/data/2026/CVE-2026-63147.json
index 738376bd24..a0108efefd 100644
--- a/data/2026/CVE-2026-63147.json
+++ b/data/2026/CVE-2026-63147.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers."}],"id":"CVE-2026-63147","lastModified":"2026-10-17T02:17:20.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:47:32.888215Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-uploaded-file-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers."}],"id":"CVE-2026-63147","lastModified":"2026-11-13T18:17:43.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63147","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:47:32.888215Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.350","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63147-stored-xss-via-uploaded-file-name"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-uploaded-file-name"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63148.json b/data/2026/CVE-2026-63148.json
index 9bd2fb6d6a..a02fd39092 100644
--- a/data/2026/CVE-2026-63148.json
+++ b/data/2026/CVE-2026-63148.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page."}],"id":"CVE-2026-63148","lastModified":"2026-10-15T15:12:54.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:48:39.574820Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.487","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-poll-response-attachment-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page."}],"id":"CVE-2026-63148","lastModified":"2026-11-13T18:17:43.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63148","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:48:39.574820Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.487","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63148-stored-xss-via-poll-response-attachment-filename"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-poll-response-attachment-filename"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63149.json b/data/2026/CVE-2026-63149.json
index 61e430e3c0..160632f9a3 100644
--- a/data/2026/CVE-2026-63149.json
+++ b/data/2026/CVE-2026-63149.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in."}],"id":"CVE-2026-63149","lastModified":"2026-10-15T15:12:54.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:43:04.874388Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.617","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-default-password-via-uniqid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in."}],"id":"CVE-2026-63149","lastModified":"2026-11-13T18:17:44.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:43:04.874388Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.617","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63149-predictable-default-password-via-uniqid"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-default-password-via-uniqid"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63150.json b/data/2026/CVE-2026-63150.json
new file mode 100644
index 0000000000..1739ea8a00
--- /dev/null
+++ b/data/2026/CVE-2026-63150.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link or auto-navigating page that issues a plain GET request, exploiting the lack of CSRF protection and SameSite=Lax cookie behavior on top-level navigations to create unauthorized administrator accounts."}],"id":"CVE-2026-63150","lastModified":"2026-11-13T18:17:44.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:33.417","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63150-no-csrf-protection-and-unsecure-cookies-leads-to-administrator-cr"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-csrf-via-administrator-account-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63151.json b/data/2026/CVE-2026-63151.json
new file mode 100644
index 0000000000..3c9ca98ea1
--- /dev/null
+++ b/data/2026/CVE-2026-63151.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to access private calendar data by exploiting a missing dateCrea value that causes the md5Id token to collapse to md5(calendarId.userId), both small enumerable integers. Attackers can compute valid tokens and request the misc&action=DisplayIcal endpoint with a forged md5Id to read any user's private calendar events without authentication."}],"id":"CVE-2026-63151","lastModified":"2026-11-13T18:17:44.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:33.570","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63151-personal-calendars-zero-entropy-md5id-share-token-allows-unauthen"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-token-information-disclosure-via-displayical"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63152.json b/data/2026/CVE-2026-63152.json
index f30d4f8008..df196c14dd 100644
--- a/data/2026/CVE-2026-63152.json
+++ b/data/2026/CVE-2026-63152.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation."}],"id":"CVE-2026-63152","lastModified":"2026-10-17T02:17:20.270","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:46:07.223493Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.750","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-second-order-sql-injection-via-idcategoryfilter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation."}],"id":"CVE-2026-63152","lastModified":"2026-11-13T18:17:44.383","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:46:07.223493Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.750","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63152-second-order-sql-injection-via-idcategoryfilter"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-second-order-sql-injection-via-idcategoryfilter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63153.json b/data/2026/CVE-2026-63153.json
index 8c028d83e9..b5709dbeca 100644
--- a/data/2026/CVE-2026-63153.json
+++ b/data/2026/CVE-2026-63153.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces."}],"id":"CVE-2026-63153","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:49:42.806550Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.880","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-setaffectations"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces."}],"id":"CVE-2026-63153","lastModified":"2026-11-13T18:17:44.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:49:42.806550Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:30.880","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63153-broken-access-control-via-setaffectations"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-setaffectations"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63154.json b/data/2026/CVE-2026-63154.json
index 013650ed53..3767f2d29f 100644
--- a/data/2026/CVE-2026-63154.json
+++ b/data/2026/CVE-2026-63154.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges."}],"id":"CVE-2026-63154","lastModified":"2026-10-15T15:12:54.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63154","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:43:38.472284Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.010","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-identifier-injection-via-agorafields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges."}],"id":"CVE-2026-63154","lastModified":"2026-11-13T18:17:44.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63154","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:43:38.472284Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.010","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63154-sql-identifier-injection-via-agorafields"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-identifier-injection-via-agorafields"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63155.json b/data/2026/CVE-2026-63155.json
new file mode 100644
index 0000000000..b315d0e847
--- /dev/null
+++ b/data/2026/CVE-2026-63155.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirect users to arbitrary external URLs by manipulating the objUrl parameter in Ctrl.php's redir() function. Attackers can craft login links with objUrl set to a malicious site, causing the application to issue an HTTP 302 redirect to that external URL, which can be abused for phishing and credential theft."}],"id":"CVE-2026-63155","lastModified":"2026-11-13T18:17:44.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:33.710","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63155-open-redirect-and-reflected-xss-via-objurl"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-open-redirect-via-objurl-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63156.json b/data/2026/CVE-2026-63156.json
index 3f86909583..f6bb1a33b6 100644
--- a/data/2026/CVE-2026-63156.json
+++ b/data/2026/CVE-2026-63156.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php."}],"id":"CVE-2026-63156","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63156","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:53:23.496838Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.243","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-reflected-xss-via-visiourl-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php."}],"id":"CVE-2026-63156","lastModified":"2026-11-13T18:17:44.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63156","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:53:23.496838Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.243","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63156-reflected-xss-via-visiourl-parameter"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-reflected-xss-via-visiourl-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63157.json b/data/2026/CVE-2026-63157.json
index 1f9698cae9..94d07e94e5 100644
--- a/data/2026/CVE-2026-63157.json
+++ b/data/2026/CVE-2026-63157.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise."}],"id":"CVE-2026-63157","lastModified":"2026-10-15T14:47:05.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T18:42:38.504706Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.383","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-links-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise."}],"id":"CVE-2026-63157","lastModified":"2026-11-13T18:17:45.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T18:42:38.504706Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.383","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63157-stored-xss-via-links-module"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-links-module"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63158.json b/data/2026/CVE-2026-63158.json
index 6dcf7ea744..ec1c14b063 100644
--- a/data/2026/CVE-2026-63158.json
+++ b/data/2026/CVE-2026-63158.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application."}],"id":"CVE-2026-63158","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:49:44.250105Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.143","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-pass-the-hash-authentication-bypass-via-cookies"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-836"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application."}],"id":"CVE-2026-63158","lastModified":"2026-11-13T18:17:45.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63158","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:49:44.250105Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.143","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63158-pass-the-hash-authentication-bypass-via-cookies"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-pass-the-hash-authentication-bypass-via-cookies"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-836"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63159.json b/data/2026/CVE-2026-63159.json
index b065a8ea05..2f215210b0 100644
--- a/data/2026/CVE-2026-63159.json
+++ b/data/2026/CVE-2026-63159.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts."}],"id":"CVE-2026-63159","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63159","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T20:02:50.106501Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-password-reset-token-account-takeover"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts."}],"id":"CVE-2026-63159","lastModified":"2026-11-13T18:17:45.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63159","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T20:02:50.106501Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63159-predictable-password-reset-token-account-takeover"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-password-reset-token-account-takeover"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63160.json b/data/2026/CVE-2026-63160.json
index 3a566e2a29..675a6f9b8d 100644
--- a/data/2026/CVE-2026-63160.json
+++ b/data/2026/CVE-2026-63160.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password."}],"id":"CVE-2026-63160","lastModified":"2026-10-18T13:16:39.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:28.172144Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password."}],"id":"CVE-2026-63160","lastModified":"2026-11-13T18:17:45.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:28.172144Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63160-insecure-remember-me-token-storage"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-insecure-remember-me-token-storage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63161.json b/data/2026/CVE-2026-63161.json
index d507b3cbee..6329c155bd 100644
--- a/data/2026/CVE-2026-63161.json
+++ b/data/2026/CVE-2026-63161.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in."}],"id":"CVE-2026-63161","lastModified":"2026-10-15T14:47:05.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T18:44:28.358738Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-session-fixation-via-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id upon successful authentication to gain unauthorized access to the victim's authenticated session after they log in."}],"id":"CVE-2026-63161","lastModified":"2026-11-13T18:17:45.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T18:44:28.358738Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.550","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63161-session-fixation-via-authentication"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-session-fixation-via-authentication"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-384"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63162.json b/data/2026/CVE-2026-63162.json
index 2044859425..c2a901132a 100644
--- a/data/2026/CVE-2026-63162.json
+++ b/data/2026/CVE-2026-63162.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution."}],"id":"CVE-2026-63162","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:52:09.234552Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.687","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-path-traversal-via-tmpfoldername-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution."}],"id":"CVE-2026-63162","lastModified":"2026-11-13T18:17:45.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63162","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-14T14:52:09.234552Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.687","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63162-path-traversal-via-tmpfoldername-parameter"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-path-traversal-via-tmpfoldername-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63163.json b/data/2026/CVE-2026-63163.json
index 2a4544546b..0c9ad247ae 100644
--- a/data/2026/CVE-2026-63163.json
+++ b/data/2026/CVE-2026-63163.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure."}],"id":"CVE-2026-63163","lastModified":"2026-10-15T15:52:40.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63163","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-13T20:06:49.508366Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.817","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-mobilefiledownload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure."}],"id":"CVE-2026-63163","lastModified":"2026-11-13T18:17:46.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63163","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-13T20:06:49.508366Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.817","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63163-broken-access-control-via-mobilefiledownload"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-mobilefiledownload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63164.json b/data/2026/CVE-2026-63164.json
new file mode 100644
index 0000000000..e605330a74
--- /dev/null
+++ b/data/2026/CVE-2026-63164.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readRight() ownership check in CtrlMail.php. Attackers can manipulate the mail identifier value, such as reloadMailTypeId=mail-1, to retrieve the title and body of private messages belonging to other users, resulting in unauthorized disclosure of sensitive communications."}],"id":"CVE-2026-63164","lastModified":"2026-11-13T18:17:46.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:33.850","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63164-idor-in-reloadmailtypeid-allows-reading-and-exfiltration-of-other"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-idor-via-reloadmailtypeid-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63165.json b/data/2026/CVE-2026-63165.json
index 37bc9cb1b9..c6b7cf24c9 100644
--- a/data/2026/CVE-2026-63165.json
+++ b/data/2026/CVE-2026-63165.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system."}],"id":"CVE-2026-63165","lastModified":"2026-10-18T13:16:39.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:42.134127Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.947","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-injection-via-sortevents-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in app/ModCalendar/CtrlCalendar.php. Attackers can exploit this flaw using error-based techniques such as extractvalue payloads to extract database information, including version data, from the underlying system."}],"id":"CVE-2026-63165","lastModified":"2026-11-13T18:17:46.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63165","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:42.134127Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:31.947","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63165-sql-injection-via-sortevents-parameter"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-injection-via-sortevents-parameter"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63166.json b/data/2026/CVE-2026-63166.json
new file mode 100644
index 0000000000..92d26b88ac
--- /dev/null
+++ b/data/2026/CVE-2026-63166.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context."}],"id":"CVE-2026-63166","lastModified":"2026-11-13T18:17:46.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:33.997","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63166-second-order-xss-in-ldap-import-preview"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-csv-import-preview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63167.json b/data/2026/CVE-2026-63167.json
new file mode 100644
index 0000000000..92671f729a
--- /dev/null
+++ b/data/2026/CVE-2026-63167.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages."}],"id":"CVE-2026-63167","lastModified":"2026-11-13T18:17:47.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:34.137","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63167-second-order-sql-injection-order-by-via-personssort"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-sql-injection-via-personssort-session-value"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63168.json b/data/2026/CVE-2026-63168.json
index 3ba88dd641..be1a5d1065 100644
--- a/data/2026/CVE-2026-63168.json
+++ b/data/2026/CVE-2026-63168.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers."}],"id":"CVE-2026-63168","lastModified":"2026-10-18T13:16:39.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:12:11.024333Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-nested-post-array-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers."}],"id":"CVE-2026-63168","lastModified":"2026-11-13T18:17:47.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:12:11.024333Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.763","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63168-stored-xss-via-nested-post-array-bypass"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-nested-post-array-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63169.json b/data/2026/CVE-2026-63169.json
index e6a66017da..8d9e51bbdc 100644
--- a/data/2026/CVE-2026-63169.json
+++ b/data/2026/CVE-2026-63169.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers."}],"id":"CVE-2026-63169","lastModified":"2026-10-17T02:17:20.390","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:48:09.231159Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-messenger-iframe"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers."}],"id":"CVE-2026-63169","lastModified":"2026-11-13T18:17:47.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:48:09.231159Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:40.893","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63169-stored-xss-via-messenger-iframe"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-messenger-iframe"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63170.json b/data/2026/CVE-2026-63170.json
new file mode 100644
index 0000000000..993f262b31
--- /dev/null
+++ b/data/2026/CVE-2026-63170.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticated attackers to forge the shared-calendar iCal share token by deriving md5Id() from predictable fields such as object creation time, which is self-disclosed through autorDate and the iCal CREATED field. Attackers can compute the creation minute and forge the md5Id token to access and read a shared calendar's iCal feed without authorization."}],"id":"CVE-2026-63170","lastModified":"2026-11-13T18:17:47.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T17:17:34.280","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63170-shared-calendar-ical-share-token-forgeable-from-a-leaked-creation"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-predictable-share-token-via-md5id"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-340"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63171.json b/data/2026/CVE-2026-63171.json
index c76c884caa..c018aabe1b 100644
--- a/data/2026/CVE-2026-63171.json
+++ b/data/2026/CVE-2026-63171.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category."}],"id":"CVE-2026-63171","lastModified":"2026-10-15T15:12:54.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:50:24.747836Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:41.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-category-description"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category."}],"id":"CVE-2026-63171","lastModified":"2026-11-13T18:17:47.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63171","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-14T16:50:24.747836Z","version":"2.0.3"}}]},"published":"2026-10-13T21:17:41.027","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63171-stored-xss-via-category-description"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-stored-xss-via-category-description"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63172.json b/data/2026/CVE-2026-63172.json
index 7ae2863eb0..00288f38ba 100644
--- a/data/2026/CVE-2026-63172.json
+++ b/data/2026/CVE-2026-63172.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation."}],"id":"CVE-2026-63172","lastModified":"2026-10-18T13:16:39.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:50.629851Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:32.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-function-level-authorization-via-user-edit"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. Attackers can exploit the missing editRight() enforcement in actionVueEditUser to create unauthorized user accounts, leading to privilege escalation."}],"id":"CVE-2026-63172","lastModified":"2026-11-13T18:17:48.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63172","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-18T12:11:50.629851Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:32.080","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63172-broken-function-level-authorization-via-user-edit"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-function-level-authorization-via-user-edit"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63173.json b/data/2026/CVE-2026-63173.json
new file mode 100644
index 0000000000..8c75dc67e5
--- /dev/null
+++ b/data/2026/CVE-2026-63173.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThanOrEqual":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Attackers who were previously members and authored objects can retain unauthorized read access to space objects even after being removed from the space, leading to persistent information disclosure."}],"id":"CVE-2026-63173","lastModified":"2026-11-13T18:17:48.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-13T18:17:48.463","references":[{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63173-stale-author-access-after-space-revocation-via-isautor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-isautor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-63174.json b/data/2026/CVE-2026-63174.json
index 9fe642e602..a58414228e 100644
--- a/data/2026/CVE-2026-63174.json
+++ b/data/2026/CVE-2026-63174.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces."}],"id":"CVE-2026-63174","lastModified":"2026-10-17T02:17:20.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:46:53.388418Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:32.217","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-spaceaffectlist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/xech/agora-project","product":"Agora Project","repo":"https://github.com/xech/agora-project","vendor":"Omnispace","versions":[{"lessThan":"26.10.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verifying the caller's rights to the target space. Attackers can exploit the missing readRight() check in the import flow's join INSERT to break tenant isolation and manipulate user-space assignments across unauthorized spaces."}],"id":"CVE-2026-63174","lastModified":"2026-11-13T18:17:48.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-17T00:46:53.388418Z","version":"2.0.3"}}]},"published":"2026-10-13T20:17:32.217","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/xech/agora-project/releases/tag/26.10"},{"source":"disclosure@vulncheck.com","url":"https://www.agora-project.net/"},{"source":"disclosure@vulncheck.com","url":"https://www.akailabs.fr/blog/multiple-vulnerabilities-in-agora-project-26-5-2#cve-2026-63174-broken-access-control-via-spaceaffectlist"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/omnispace-agora-project-broken-access-control-via-spaceaffectlist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-63660.json b/data/2026/CVE-2026-63660.json
index 9f5b74acaf..a97ea9ce1f 100644
--- a/data/2026/CVE-2026-63660.json
+++ b/data/2026/CVE-2026-63660.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"node-fontnik","vendor":"mapbox","versions":[{"status":"affected","version":"< 0.7.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7."}],"id":"CVE-2026-63660","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T03:16:52.367","references":[{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/pull/202"},{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7"},{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"node-fontnik","vendor":"mapbox","versions":[{"status":"affected","version":"< 0.7.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). RenderSDF computed the SDF bitmap allocation size as buffered_width * buffered_height in 32-bit unsigned int. Glyph dimensions are derived from the uploaded font's outline bounding box with no upper bound, so a glyph large enough to make that product exceed 2³² wrapped to a small value. The buffer was then under-allocated while the render loop still wrote one byte per pixel, corrupting the heap (CWE-190 → CWE-787) and crashing the process. A 680-byte font is enough to drive FreeType to a 65536×65536 buffered glyph, wrapping the size to 0. This issue has been patched in version 0.7.7."}],"id":"CVE-2026-63660","lastModified":"2026-11-13T17:17:34.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63660","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:58:14.309072Z","version":"2.0.3"}}]},"published":"2026-11-11T03:16:52.367","references":[{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/pull/202"},{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/releases/tag/v0.7.7"},{"source":"security-advisories@github.com","url":"https://github.com/mapbox/node-fontnik/security/advisories/GHSA-cfm6-c7rv-58xj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64530.json b/data/2026/CVE-2026-64530.json
index 074637d8e5..14ff9c8f71 100644
--- a/data/2026/CVE-2026-64530.json
+++ b/data/2026/CVE-2026-64530.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ed3d6f85991656667059d3fa5a1d683ac58c447","status":"affected","version":"172ba7d46c202e679f3ccb10264c67416aaeb1c4","versionType":"git"},{"lessThan":"f42e8134a3a1074b834a574d404352f867ba994a","status":"affected","version":"0b5b831122fc3789fff75be433ba3e4dd7b779d4","versionType":"git"},{"lessThan":"447d493034a9cf7bf13a2abac86d0573d907ec2f","status":"affected","version":"73f7da5fd124f2cda9161e2e46114915e6e82e97","versionType":"git"},{"lessThan":"e1270e69dcf2c3512c453484178f2e9dc0db3f05","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"2140c2f3f2e7b066e1ae616ede8856cafd8015e9","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"e28aedab9488343924d227b5a896faed67ce84d5","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"a8a02897f2b479127db261de05cbf0c28b98d159","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"status":"affected","version":"f5346df0591d10bc948761ca854b1fae6d2ef441","versionType":"git"},{"lessThan":"5.15.212","status":"affected","version":"5.15.148","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.75","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.14","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns  in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n  tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n  tc filter add block 10 ... action ct\n\n  (with ct defrag enabled and traffic that produces out-of-order\n  fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us."}],"id":"CVE-2026-64530","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64530","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:44.353854Z","version":"2.0.3"}}]},"published":"2026-07-26T07:16:41.680","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ed3d6f85991656667059d3fa5a1d683ac58c447","status":"affected","version":"172ba7d46c202e679f3ccb10264c67416aaeb1c4","versionType":"git"},{"lessThan":"f42e8134a3a1074b834a574d404352f867ba994a","status":"affected","version":"0b5b831122fc3789fff75be433ba3e4dd7b779d4","versionType":"git"},{"lessThan":"447d493034a9cf7bf13a2abac86d0573d907ec2f","status":"affected","version":"73f7da5fd124f2cda9161e2e46114915e6e82e97","versionType":"git"},{"lessThan":"e1270e69dcf2c3512c453484178f2e9dc0db3f05","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"2140c2f3f2e7b066e1ae616ede8856cafd8015e9","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"e28aedab9488343924d227b5a896faed67ce84d5","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"lessThan":"a8a02897f2b479127db261de05cbf0c28b98d159","status":"affected","version":"3f14b377d01d8357eba032b4cabc8c1149b458b6","versionType":"git"},{"status":"affected","version":"f5346df0591d10bc948761ca854b1fae6d2ef441","versionType":"git"},{"lessThan":"5.15.212","status":"affected","version":"5.15.148","versionType":"semver"},{"lessThan":"6.1.178","status":"affected","version":"6.1.75","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.14","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/cls_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"81006F8F-DDE6-43DB-A9CE-B235048A8E5C","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15.148","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FC56DFDB-4DFE-4EBE-924F-0F1EE7C6604C","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6CBCD5D0-7F6B-4BB3-A5F5-A8D944691BDC","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2546B8AE-FCD4-471D-9ED0-0A15E26EFD33","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns  in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n  tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n  tc filter add block 10 ... action ct\n\n  (with ct defrag enabled and traffic that produces out-of-order\n  fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us."}],"id":"CVE-2026-64530","lastModified":"2026-11-13T18:27:42.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64530","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:41:44.353854Z","version":"2.0.3"}}]},"published":"2026-07-26T07:16:41.680","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64539.json b/data/2026/CVE-2026-64539.json
index ebbccf34e1..022f056620 100644
--- a/data/2026/CVE-2026-64539.json
+++ b/data/2026/CVE-2026-64539.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/eir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f0b6232af56441d0a2dcb173cc4f8d8aab39014","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"9174992ee1045c9c96e53eecda64f49dd7e8fbba","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"09301f1fdf2aef8cce34d0c4650c30e7edb1ced9","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"f1b4df9c260c51726da2e86e19322825fddeefd0","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"57077eeb586c42f124bc09e018449362223067b3","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"6f5fb689fdf80bdd143f22a502f9eb1f3c85e286","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/eir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv->adv_data, adv->adv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n  BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n  Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n  Workqueue: hci0 hci_cmd_sync_work\n   __asan_memcpy (mm/kasan/shadow.c:106)\n   eir_create_adv_data (net/bluetooth/eir.c:301)\n   hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n   hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n   hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n  This frame has 1 object:\n   [32, 64) 'cp'\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."}],"id":"CVE-2026-64539","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:00.875042Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9174992ee1045c9c96e53eecda64f49dd7e8fbba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/eir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0f0b6232af56441d0a2dcb173cc4f8d8aab39014","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"9174992ee1045c9c96e53eecda64f49dd7e8fbba","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"09301f1fdf2aef8cce34d0c4650c30e7edb1ced9","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"f1b4df9c260c51726da2e86e19322825fddeefd0","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"57077eeb586c42f124bc09e018449362223067b3","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"},{"lessThan":"6f5fb689fdf80bdd143f22a502f9eb1f3c85e286","status":"affected","version":"b44133ff03be30b55f23036e62f403a3f7784fce","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/eir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"746E9362-BD2A-4210-8EC5-4971697C2B5D","versionEndExcluding":"6.1.178","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F4346054-F978-40BD-BC1C-32AA73CA50DD","versionEndExcluding":"6.6.160","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv->adv_data, adv->adv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n  BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n  Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n  Workqueue: hci0 hci_cmd_sync_work\n   __asan_memcpy (mm/kasan/shadow.c:106)\n   eir_create_adv_data (net/bluetooth/eir.c:301)\n   hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n   hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n   hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n  This frame has 1 object:\n   [32, 64) 'cp'\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."}],"id":"CVE-2026-64539","lastModified":"2026-11-13T18:27:23.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:00.875042Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.277","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9174992ee1045c9c96e53eecda64f49dd7e8fbba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64540.json b/data/2026/CVE-2026-64540.json
index aa19197785..37a95fc9f9 100644
--- a/data/2026/CVE-2026-64540.json
+++ b/data/2026/CVE-2026-64540.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/gl620a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"255d03551f94c7bdd86c7d9181a70b21917d829f","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"4359376e6238d89977a35086e47ca3b07f43e850","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"8624e179fa3ce23c2fbd1a198ce30764b73f054a","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"573418f7ea8f859a841417eb4b915594094fd967","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"0575599e451aff3c5329922562374a2cab25fc51","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"3ef79fa3860e644c8de7834fa7300e1c58f38862","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/gl620a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.14"},{"lessThan":"2.6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()\n\ngenelink_rx_fixup() splits an aggregated RX frame into its individual\npackets, using a per-packet length taken from device-supplied data. That\nlength is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared\nagainst how many bytes were actually received.\n\nA malicious GeneLink (GL620A) device can therefore send a short URB whose\nheader claims packet_count > 1 and a first packet of up to 1514 bytes.\n\n\tskb_put_data(gl_skb, packet->packet_data, size);\n\nthen copies past the end of the receive buffer and hands the adjacent slab\ncontents up the network stack, an out-of-bounds read that leaks kernel heap.\nNo privilege is required: the path runs in the usbnet RX softirq as soon as\nthe interface is up.\n\n  BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)\n  Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14\n  Call Trace:\n    ...\n    __asan_memcpy (mm/kasan/shadow.c:105)\n    genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)\n    usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)\n    process_one_work (kernel/workqueue.c:3322)\n    bh_worker (kernel/workqueue.c:3405)\n    tasklet_action (kernel/softirq.c:965)\n    handle_softirqs (kernel/softirq.c:622)\n    run_ksoftirqd (kernel/softirq.c:1076)\n    ...\n\nskb_pull() already verifies that the requested length fits the buffer and\nreturns NULL otherwise. Move it ahead of the copy and check its result, so\na packet that overruns the received data is rejected before it is read.\nWell-formed frames, whose packets are fully present, are unaffected."}],"id":"CVE-2026-64540","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:07.103763Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.407","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/gl620a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"255d03551f94c7bdd86c7d9181a70b21917d829f","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"4359376e6238d89977a35086e47ca3b07f43e850","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"8624e179fa3ce23c2fbd1a198ce30764b73f054a","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"573418f7ea8f859a841417eb4b915594094fd967","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"0575599e451aff3c5329922562374a2cab25fc51","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"3ef79fa3860e644c8de7834fa7300e1c58f38862","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"},{"lessThan":"8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a","status":"affected","version":"47ee3051c856cc2aa95d35d577a8cb37279d540f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/gl620a.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.14"},{"lessThan":"2.6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96052A1E-07BD-4703-A697-D6C0FCAD72D5","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()\n\ngenelink_rx_fixup() splits an aggregated RX frame into its individual\npackets, using a per-packet length taken from device-supplied data. That\nlength is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared\nagainst how many bytes were actually received.\n\nA malicious GeneLink (GL620A) device can therefore send a short URB whose\nheader claims packet_count > 1 and a first packet of up to 1514 bytes.\n\n\tskb_put_data(gl_skb, packet->packet_data, size);\n\nthen copies past the end of the receive buffer and hands the adjacent slab\ncontents up the network stack, an out-of-bounds read that leaks kernel heap.\nNo privilege is required: the path runs in the usbnet RX softirq as soon as\nthe interface is up.\n\n  BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)\n  Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14\n  Call Trace:\n    ...\n    __asan_memcpy (mm/kasan/shadow.c:105)\n    genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)\n    usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)\n    process_one_work (kernel/workqueue.c:3322)\n    bh_worker (kernel/workqueue.c:3405)\n    tasklet_action (kernel/softirq.c:965)\n    handle_softirqs (kernel/softirq.c:622)\n    run_ksoftirqd (kernel/softirq.c:1076)\n    ...\n\nskb_pull() already verifies that the requested length fits the buffer and\nreturns NULL otherwise. Move it ahead of the copy and check its result, so\na packet that overruns the received data is rejected before it is read.\nWell-formed frames, whose packets are fully present, are unaffected."}],"id":"CVE-2026-64540","lastModified":"2026-11-13T18:26:54.637","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:07.103763Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.407","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64541.json b/data/2026/CVE-2026-64541.json
index ece3e5f2aa..c0bdc513f5 100644
--- a/data/2026/CVE-2026-64541.json
+++ b/data/2026/CVE-2026-64541.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/smc/smc_cdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8de4f665d0febfb92803dece377791a563fc7041","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"8145b432136285e01091815b48ceb2dae261f262","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"1951bffbc6493ec34cff3956b29d4bc6606904a6","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"647b19e5cc145a2f1f685ae8ff3805a17356888c","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"472e9d7c0d5b03be3ff91ff941f57da822b031bc","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"ce5aa8084329351086894aa34d77e40301d5bd3d","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"9d160b35cc34a2ba8229d07651468a7848325135","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/smc/smc_cdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup's conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(&smc->sk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler's later\nsock_hold() runs on freed memory:\n\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate\n  Workqueue: rxe_wq do_work\n   refcount_warn_saturate (lib/refcount.c:25)\n   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n   tasklet_action_common (kernel/softirq.c:938)\n   handle_softirqs (kernel/softirq.c:622)\n  Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."}],"id":"CVE-2026-64541","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:09.809089Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.570","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/smc/smc_cdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8de4f665d0febfb92803dece377791a563fc7041","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"8145b432136285e01091815b48ceb2dae261f262","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"1951bffbc6493ec34cff3956b29d4bc6606904a6","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"647b19e5cc145a2f1f685ae8ff3805a17356888c","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"472e9d7c0d5b03be3ff91ff941f57da822b031bc","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"ce5aa8084329351086894aa34d77e40301d5bd3d","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"},{"lessThan":"9d160b35cc34a2ba8229d07651468a7848325135","status":"affected","version":"d7b0e37c1ac152905b18a5b9506179091a35b0b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/smc/smc_cdc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36CDDF17-1AFE-4A79-92E4-5834FA738429","versionEndExcluding":"5.10.261","versionStartIncluding":"4.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup's conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(&smc->sk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler's later\nsock_hold() runs on freed memory:\n\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate\n  Workqueue: rxe_wq do_work\n   refcount_warn_saturate (lib/refcount.c:25)\n   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n   tasklet_action_common (kernel/softirq.c:938)\n   handle_softirqs (kernel/softirq.c:622)\n  Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."}],"id":"CVE-2026-64541","lastModified":"2026-11-13T18:26:37.570","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64541","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:09.809089Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.570","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64543.json b/data/2026/CVE-2026-64543.json
index 2e3c33b8b8..b73a58758f 100644
--- a/data/2026/CVE-2026-64543.json
+++ b/data/2026/CVE-2026-64543.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tipc/core.c","net/tipc/discover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"380413cdfd29fb9fa486c82889132b680c4983c5","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"f05b3f4c78370469286879c765f5a1dd39dbcd32","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"4da2ac7749411971e1b222b992da5a172ce45f98","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"5e215bf1c47fdddf8203a0fe80a0ed594065f101","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"ec7d54d8cc1723921d671e3272b427c96366506f","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"b65289e1c3f352a9f92c6e19713ddd647e033253","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"1579342d71133da7f00daa02c75cebec7372097b","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tipc/core.c","net/tipc/discover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.17"},{"lessThan":"4.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),\nbut tipc_disc_rcv() still dereferences b->disc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n <IRQ>\n  tipc_disc_rcv (net/tipc/discover.c:149)\n  tipc_rcv (net/tipc/node.c:2126)\n  tipc_udp_recv (net/tipc/udp_media.c:391)\n  udp_rcv (net/ipv4/udp.c:2643)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n </IRQ>\n Freed by task 181:\n  kfree (mm/slub.c:6565)\n  bearer_disable (net/tipc/bearer.c:418)\n  tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."}],"id":"CVE-2026-64543","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:12.338756Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/380413cdfd29fb9fa486c82889132b680c4983c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4da2ac7749411971e1b222b992da5a172ce45f98"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f05b3f4c78370469286879c765f5a1dd39dbcd32"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tipc/core.c","net/tipc/discover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"380413cdfd29fb9fa486c82889132b680c4983c5","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"f05b3f4c78370469286879c765f5a1dd39dbcd32","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"4da2ac7749411971e1b222b992da5a172ce45f98","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"5e215bf1c47fdddf8203a0fe80a0ed594065f101","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"ec7d54d8cc1723921d671e3272b427c96366506f","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"b65289e1c3f352a9f92c6e19713ddd647e033253","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"},{"lessThan":"1579342d71133da7f00daa02c75cebec7372097b","status":"affected","version":"25b0b9c4e835ffaa65b61c3efe2e28acf84d0259","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tipc/core.c","net/tipc/discover.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.17"},{"lessThan":"4.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0E0297DC-D180-42A0-A860-A96B43B7B844","versionEndExcluding":"5.10.265","versionStartIncluding":"4.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E53EBB9F-3754-42D9-9B1B-A16E73848ED3","versionEndExcluding":"5.15.216","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),\nbut tipc_disc_rcv() still dereferences b->disc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n <IRQ>\n  tipc_disc_rcv (net/tipc/discover.c:149)\n  tipc_rcv (net/tipc/node.c:2126)\n  tipc_udp_recv (net/tipc/udp_media.c:391)\n  udp_rcv (net/ipv4/udp.c:2643)\n  ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n </IRQ>\n Freed by task 181:\n  kfree (mm/slub.c:6565)\n  bearer_disable (net/tipc/bearer.c:418)\n  tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."}],"id":"CVE-2026-64543","lastModified":"2026-11-13T18:26:15.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:12.338756Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:06.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/380413cdfd29fb9fa486c82889132b680c4983c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4da2ac7749411971e1b222b992da5a172ce45f98"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f05b3f4c78370469286879c765f5a1dd39dbcd32"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64545.json b/data/2026/CVE-2026-64545.json
index 143c400a3e..6805ad869b 100644
--- a/data/2026/CVE-2026-64545.json
+++ b/data/2026/CVE-2026-64545.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c99ca049e910d61ddbd28cc2c47242f2bfbb4970","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"e2a56441233131fe18a76001de347ecda217e40c","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"3876318ea54e83eb70982b8280a3c5e4e32269bf","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"4edbcacca09f92b85d3951b6add11894b20a84bc","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"03b743586a2469744e96e9c1015096d07240935d","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"89c103d702b25ceb2d097faf854deb47b53b17ff","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"e82d8cc4321c373dc46e741cd2dfdaa7921fddb7","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet, bpf: check master for NULL in xdp_master_redirect()\n\nxdp_master_redirect() dereferences the result of\nnetdev_master_upper_dev_get_rcu() without a NULL check, but that helper\nreturns NULL when the receiving device has no upper-master adjacency.\n\nThe reach guard only checks netif_is_bond_slave(). On bond slave release\nbond_upper_dev_unlink() drops the upper-master adjacency before clearing\nIFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window\nstill passes netif_is_bond_slave() while master is already NULL, and\nfaults on master->flags at offset 0xb0:\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000b0\n  RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)\n  Call Trace:\n   xdp_master_redirect (net/core/filter.c:4432)\n   bpf_prog_run_generic_xdp (include/net/xdp.h:700)\n   do_xdp_generic (net/core/dev.c:5608)\n   __netif_receive_skb_one_core (net/core/dev.c:6204)\n   process_backlog (net/core/dev.c:6319)\n   __napi_poll (net/core/dev.c:7729)\n   net_rx_action (net/core/dev.c:7792)\n   handle_softirqs (kernel/softirq.c:622)\n   __dev_queue_xmit (include/linux/bottom_half.h:33)\n   packet_sendmsg (net/packet/af_packet.c:3082)\n   __sys_sendto (net/socket.c:2252)\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe missing check dates back to the original code; commit 1921f91298d1\n(\"net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master\")\nlater added the master->flags read where the fault now lands but kept the\nunconditional deref. Check master for NULL before use; a NULL master is\ntreated the same as one that is not up."}],"id":"CVE-2026-64545","lastModified":"2026-11-10T13:19:37.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64545","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:14.941919Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c99ca049e910d61ddbd28cc2c47242f2bfbb4970","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"e2a56441233131fe18a76001de347ecda217e40c","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"3876318ea54e83eb70982b8280a3c5e4e32269bf","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"4edbcacca09f92b85d3951b6add11894b20a84bc","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"03b743586a2469744e96e9c1015096d07240935d","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"89c103d702b25ceb2d097faf854deb47b53b17ff","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"},{"lessThan":"e82d8cc4321c373dc46e741cd2dfdaa7921fddb7","status":"affected","version":"879af96ffd72706c6e3278ea6b45b0b0e37ec5d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"132654BF-995B-47EE-90A9-B2330612B436","versionEndExcluding":"5.15.212","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet, bpf: check master for NULL in xdp_master_redirect()\n\nxdp_master_redirect() dereferences the result of\nnetdev_master_upper_dev_get_rcu() without a NULL check, but that helper\nreturns NULL when the receiving device has no upper-master adjacency.\n\nThe reach guard only checks netif_is_bond_slave(). On bond slave release\nbond_upper_dev_unlink() drops the upper-master adjacency before clearing\nIFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window\nstill passes netif_is_bond_slave() while master is already NULL, and\nfaults on master->flags at offset 0xb0:\n\n  BUG: kernel NULL pointer dereference, address: 00000000000000b0\n  RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)\n  Call Trace:\n   xdp_master_redirect (net/core/filter.c:4432)\n   bpf_prog_run_generic_xdp (include/net/xdp.h:700)\n   do_xdp_generic (net/core/dev.c:5608)\n   __netif_receive_skb_one_core (net/core/dev.c:6204)\n   process_backlog (net/core/dev.c:6319)\n   __napi_poll (net/core/dev.c:7729)\n   net_rx_action (net/core/dev.c:7792)\n   handle_softirqs (kernel/softirq.c:622)\n   __dev_queue_xmit (include/linux/bottom_half.h:33)\n   packet_sendmsg (net/packet/af_packet.c:3082)\n   __sys_sendto (net/socket.c:2252)\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nThe missing check dates back to the original code; commit 1921f91298d1\n(\"net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master\")\nlater added the master->flags read where the fault now lands but kept the\nunconditional deref. Check master for NULL before use; a NULL master is\ntreated the same as one that is not up."}],"id":"CVE-2026-64545","lastModified":"2026-11-13T18:25:20.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64545","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:14.941919Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64546.json b/data/2026/CVE-2026-64546.json
index 89c49597ce..e5ce736c15 100644
--- a/data/2026/CVE-2026-64546.json
+++ b/data/2026/CVE-2026-64546.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_edid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"157727131ce8a52d8d9bc676c372ef82db6436c4","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"4f5484d25f85ad6c989bad5f6a43450cecfcfd28","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"9cc0f8e63e8c34cf43def35cbd305ba711181a1f","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"faaa1e1155833e7d4ce7e3cfaf64c0d636b190db","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_edid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile->topology_id[7] without checking block->num_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec's 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n  BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n  Read of size 2 at addr ffff888010077700 by task exploit/147\n   dump_stack_lvl (lib/dump_stack.c:94 ...)\n   print_report (mm/kasan/report.c:378 ...)\n   kasan_report (mm/kasan/report.c:595)\n   drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n   bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n   drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n   status_store (drivers/gpu/drm/drm_sysfs.c:219)\n   ...\n   vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)"}],"id":"CVE-2026-64546","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:17.796608Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/drm_edid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"157727131ce8a52d8d9bc676c372ef82db6436c4","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"4f5484d25f85ad6c989bad5f6a43450cecfcfd28","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"9cc0f8e63e8c34cf43def35cbd305ba711181a1f","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"},{"lessThan":"faaa1e1155833e7d4ce7e3cfaf64c0d636b190db","status":"affected","version":"40d9b043a89e2301e1f97ade055a73ecc28e9afe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/drm_edid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3E2290F3-E056-4C61-B1BE-28AFC4F9B7C2","versionEndExcluding":"5.10.261","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile->topology_id[7] without checking block->num_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec's 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n  BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n  Read of size 2 at addr ffff888010077700 by task exploit/147\n   dump_stack_lvl (lib/dump_stack.c:94 ...)\n   print_report (mm/kasan/report.c:378 ...)\n   kasan_report (mm/kasan/report.c:595)\n   drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n   bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n   drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n   status_store (drivers/gpu/drm/drm_sysfs.c:219)\n   ...\n   vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)"}],"id":"CVE-2026-64546","lastModified":"2026-11-13T18:24:43.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:17.796608Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64547.json b/data/2026/CVE-2026-64547.json
index eb3a16b680..c08c9831df 100644
--- a/data/2026/CVE-2026-64547.json
+++ b/data/2026/CVE-2026-64547.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/net1080.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f42217fa7d535e9ec4151f7971f06f6ea65e850a","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"c087749815379e9af2fdbeb08bfc33870b103958","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"e4a87126c085b097d29e17e3b7647295bba8be7c","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"685e92934f11d5e215dad58813e2f9955ac2f436","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"4dc8484be3302d187274364820d3bef6c62bde32","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"b153cfe84b1340c69a13d0957665a2bfcf21239c","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"ea866cab12db1a2100b400a8b03569e5bc0ee29a","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"03f384bc0cb8d4a1301d4f5b0baef2d980258383","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/net1080.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.14"},{"lessThan":"2.6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: net1080: validate packet_len before pad-byte access in rx_fixup\n\nFor an even packet_len, net1080_rx_fixup() reads the pad byte at\nskb->data[packet_len] before the skb->len != packet_len check further\ndown, and packet_len is only bounded against NC_MAX_PACKET. A malicious\nNetChip 1080 device can send a short frame advertising a large even\npacket_len (e.g. 0x4000), so the pad-byte read lands past the end of the\nskb:\n\n  BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup\n  Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14\n   ...\n   net1080_rx_fixup (drivers/net/usb/net1080.c:384)\n   usbnet_bh (drivers/net/usb/usbnet.c:1589)\n   process_one_work (kernel/workqueue.c:3322)\n   bh_worker (kernel/workqueue.c:3708)\n   tasklet_action (kernel/softirq.c:965)\n   handle_softirqs (kernel/softirq.c:622)\n   ...\n\nReject the frame when packet_len >= skb->len before reading."}],"id":"CVE-2026-64547","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:20.565927Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/net1080.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f42217fa7d535e9ec4151f7971f06f6ea65e850a","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"c087749815379e9af2fdbeb08bfc33870b103958","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"e4a87126c085b097d29e17e3b7647295bba8be7c","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"685e92934f11d5e215dad58813e2f9955ac2f436","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"4dc8484be3302d187274364820d3bef6c62bde32","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"b153cfe84b1340c69a13d0957665a2bfcf21239c","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"ea866cab12db1a2100b400a8b03569e5bc0ee29a","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"},{"lessThan":"03f384bc0cb8d4a1301d4f5b0baef2d980258383","status":"affected","version":"904813cd8a0b334189da285bb05af0b18b062502","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/net1080.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.14"},{"lessThan":"2.6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96052A1E-07BD-4703-A697-D6C0FCAD72D5","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: net1080: validate packet_len before pad-byte access in rx_fixup\n\nFor an even packet_len, net1080_rx_fixup() reads the pad byte at\nskb->data[packet_len] before the skb->len != packet_len check further\ndown, and packet_len is only bounded against NC_MAX_PACKET. A malicious\nNetChip 1080 device can send a short frame advertising a large even\npacket_len (e.g. 0x4000), so the pad-byte read lands past the end of the\nskb:\n\n  BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup\n  Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14\n   ...\n   net1080_rx_fixup (drivers/net/usb/net1080.c:384)\n   usbnet_bh (drivers/net/usb/usbnet.c:1589)\n   process_one_work (kernel/workqueue.c:3322)\n   bh_worker (kernel/workqueue.c:3708)\n   tasklet_action (kernel/softirq.c:965)\n   handle_softirqs (kernel/softirq.c:622)\n   ...\n\nReject the frame when packet_len >= skb->len before reading."}],"id":"CVE-2026-64547","lastModified":"2026-11-13T18:24:22.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:20.565927Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64548.json b/data/2026/CVE-2026-64548.json
index 4d86893652..18d1653971 100644
--- a/data/2026/CVE-2026-64548.json
+++ b/data/2026/CVE-2026-64548.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"a12b1575f9feabd91695a9e9d004862f7195fa25","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"888706a76286c547bd035432602571e8024b5305","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"db77b6bb6e6edb79b10b4efcce346eec5582d588","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"4e40056bb5c829f0423f0a6694a0477726d2147e","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"bd004716ba75fed6d185795c85cdc92540ebeaab","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"0c0a8ed85349dae298712d79cb276acfeb794d82","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n  __asan_memcpy (mm/kasan/shadow.c:105)\n  bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n  bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n  sk_psock_msg_verdict (net/core/skmsg.c:934)\n  tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n  __sys_sendto (net/socket.c:2206)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation."}],"id":"CVE-2026-64548","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:23.113167Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.570","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"a12b1575f9feabd91695a9e9d004862f7195fa25","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"888706a76286c547bd035432602571e8024b5305","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"db77b6bb6e6edb79b10b4efcce346eec5582d588","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"4e40056bb5c829f0423f0a6694a0477726d2147e","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"bd004716ba75fed6d185795c85cdc92540ebeaab","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"},{"lessThan":"0c0a8ed85349dae298712d79cb276acfeb794d82","status":"affected","version":"6fff607e2f14bd7c63c06c464a6f93b8efbabe28","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/filter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"85F18BCF-FB7D-4020-92BB-2F68D371EBAD","versionEndExcluding":"5.10.261","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n  __asan_memcpy (mm/kasan/shadow.c:105)\n  bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n  bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n  sk_psock_msg_verdict (net/core/skmsg.c:934)\n  tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n  __sys_sendto (net/socket.c:2206)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation."}],"id":"CVE-2026-64548","lastModified":"2026-11-13T18:23:59.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:23.113167Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:07.570","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64551.json b/data/2026/CVE-2026-64551.json
index f7c961a513..7bd9a06aaf 100644
--- a/data/2026/CVE-2026-64551.json
+++ b/data/2026/CVE-2026-64551.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/sm_statefuns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6022da37786701df1fc5dd946a6dcba59d5473b1","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"861f884f5471632c731cbbd612a1c072e391a624","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"588706ebaf8cdb4a4161602949eba365514b1db1","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a257b41ddfe9e327b26581ad2777f04b23ac73f5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"08a8f2d13f703924316e9aeac863a88ef50990c7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ebe0a55d954fa8da383b6192edb8f763dcb002d5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1cd23ca80784223fa2204e16203f754da4e821f8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/sm_statefuns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr   = (struct sctp_errhdr *)(chunk->skb->data);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb->tail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace."}],"id":"CVE-2026-64551","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64551","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:25.961430Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sctp/sm_statefuns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6022da37786701df1fc5dd946a6dcba59d5473b1","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"861f884f5471632c731cbbd612a1c072e391a624","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"588706ebaf8cdb4a4161602949eba365514b1db1","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a257b41ddfe9e327b26581ad2777f04b23ac73f5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"08a8f2d13f703924316e9aeac863a88ef50990c7","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ebe0a55d954fa8da383b6192edb8f763dcb002d5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1cd23ca80784223fa2204e16203f754da4e821f8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sctp/sm_statefuns.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"957C42C7-357C-4EAA-BCE7-2A8821A5B248","versionEndExcluding":"5.10.261","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr   = (struct sctp_errhdr *)(chunk->skb->data);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb->tail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace."}],"id":"CVE-2026-64551","lastModified":"2026-11-13T18:23:27.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64551","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:25.961430Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64552.json b/data/2026/CVE-2026-64552.json
index 4bbfa9a82d..799dc3958a 100644
--- a/data/2026/CVE-2026-64552.json
+++ b/data/2026/CVE-2026-64552.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9451d0fd5ba635dcabb49bfe456a6db734a8986","status":"affected","version":"82f9028e83944a9eee5229cbc6fee9be1de8a62d","versionType":"git"},{"lessThan":"38e94d63e29f4a5c6eae87ee2c02101aaa321502","status":"affected","version":"946dec89c41726b94d31147ec528b96af0be1b5a","versionType":"git"},{"lessThan":"fbeb65154583879d556ea94cb2f15888e9470f3d","status":"affected","version":"82fe78065450d2d07f36a22e2b6b44955cf5ca5b","versionType":"git"},{"lessThan":"c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"lessThan":"e6b8463b7d791f3886d7584259d6e9f06a69f12e","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"lessThan":"9e5ad06ea826322ce8c58b4a68442a96f600c3c4","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"status":"affected","version":"3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2","versionType":"git"},{"lessThan":"6.1.178","status":"affected","version":"6.1.159","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.117","versionType":"semver"},{"lessThan":"6.12.97","status":"affected","version":"6.12.58","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised."}],"id":"CVE-2026-64552","lastModified":"2026-11-10T13:19:37.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:28.527171Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.173","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9451d0fd5ba635dcabb49bfe456a6db734a8986","status":"affected","version":"82f9028e83944a9eee5229cbc6fee9be1de8a62d","versionType":"git"},{"lessThan":"38e94d63e29f4a5c6eae87ee2c02101aaa321502","status":"affected","version":"946dec89c41726b94d31147ec528b96af0be1b5a","versionType":"git"},{"lessThan":"fbeb65154583879d556ea94cb2f15888e9470f3d","status":"affected","version":"82fe78065450d2d07f36a22e2b6b44955cf5ca5b","versionType":"git"},{"lessThan":"c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"lessThan":"e6b8463b7d791f3886d7584259d6e9f06a69f12e","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"lessThan":"9e5ad06ea826322ce8c58b4a68442a96f600c3c4","status":"affected","version":"0c716703965ffc5ef4311b65cb5d84a703784717","versionType":"git"},{"status":"affected","version":"3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2","versionType":"git"},{"lessThan":"6.1.178","status":"affected","version":"6.1.159","versionType":"semver"},{"lessThan":"6.6.145","status":"affected","version":"6.6.117","versionType":"semver"},{"lessThan":"6.12.97","status":"affected","version":"6.12.58","versionType":"semver"},{"lessThan":"6.18","status":"affected","version":"6.17.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BB5B7147-A0F9-436B-B436-E67220486800","versionEndExcluding":"6.1.178","versionStartIncluding":"6.1.159","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04B3E2A2-626F-4E9B-9C9E-88013C28CDCB","versionEndExcluding":"6.6.145","versionStartIncluding":"6.6.117","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8128E37D-4745-4340-8346-74FFC4D162B2","versionEndExcluding":"6.12.97","versionStartIncluding":"6.12.58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57D56998-E0C3-4F58-BBF0-B20D1B4322C8","versionEndExcluding":"6.18","versionStartIncluding":"6.17.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"445DCCB2-104C-455B-A3D7-E6A2B6E87FEF","versionEndExcluding":"6.18.40","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*","matchCriteriaId":"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*","matchCriteriaId":"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*","matchCriteriaId":"38C4D89F-9A13-4D29-8645-C9785C142C07","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised."}],"id":"CVE-2026-64552","lastModified":"2026-11-13T18:22:56.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:28.527171Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.173","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64554.json b/data/2026/CVE-2026-64554.json
index d97903add4..cfc4ce7542 100644
--- a/data/2026/CVE-2026-64554.json
+++ b/data/2026/CVE-2026-64554.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c10778ec674b67a07ea042fcba64270f3f38a5a","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"2731efa6364e47934c96eb69e01ea131e8af8030","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"00c06ef8c018493943891a7d0ca82b71b24f3180","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"c141f69d0a0fb16964dbc293650047e69bda8af7","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"f2e6596d10783557aeb9668da2a3b4d19deb2001","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"1c4f67c89fd27c4df4c70b135c2c59627698b3c0","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"4ac981a8b7ce7aec99a52d08f8a8953e8e120067","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()\n\nbr_ip6_fragment() gets prevhdr, a pointer into the skb head, from\nip6_find_1stfragopt(), then calls skb_checksum_help().  For a cloned skb\nskb_checksum_help() reallocates the head via pskb_expand_head(), leaving\nprevhdr dangling.  It is later dereferenced in ip6_frag_next(), causing a\nuse-after-free write.\n\nSave prevhdr's offset before skb_checksum_help() and recompute it after,\nlike commit ef0efcd3bd3f (\"ipv6: Fix dangling pointer when ipv6\nfragment\").\n\n  BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)\n  Write of size 1 at addr ffff888013ff5016 by task exploit/141\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ip6_frag_next (net/ipv6/ip6_output.c:857)\n   br_ip6_fragment (net/ipv6/netfilter.c:212)\n   nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)\n   nf_hook_slow (net/netfilter/core.c:619)\n   br_forward_finish (net/bridge/br_forward.c:66)\n   __br_forward (net/bridge/br_forward.c:115)\n   maybe_deliver (net/bridge/br_forward.c:191)\n   br_flood (net/bridge/br_forward.c:245)\n   br_handle_frame_finish (net/bridge/br_input.c:229)\n   br_handle_frame (net/bridge/br_input.c:442)\n   ...\n   packet_sendmsg (net/packet/af_packet.c:3114)\n   ...\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt"}],"id":"CVE-2026-64554","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:31.205965Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.437","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c10778ec674b67a07ea042fcba64270f3f38a5a","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"2731efa6364e47934c96eb69e01ea131e8af8030","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"00c06ef8c018493943891a7d0ca82b71b24f3180","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"c141f69d0a0fb16964dbc293650047e69bda8af7","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"f2e6596d10783557aeb9668da2a3b4d19deb2001","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"1c4f67c89fd27c4df4c70b135c2c59627698b3c0","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"4ac981a8b7ce7aec99a52d08f8a8953e8e120067","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"},{"lessThan":"86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d","status":"affected","version":"764dd163ac922f8683b5bcd3007251ce7b26cd33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4E80D5DC-1315-4457-8A33-9F3C37EA4F5A","versionEndExcluding":"5.10.261","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E99FB01-CD93-41AF-A653-3F450652B9A6","versionEndExcluding":"5.15.212","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"092233C7-F4E0-40C8-BD4D-A28FE50DFE20","versionEndExcluding":"6.1.178","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()\n\nbr_ip6_fragment() gets prevhdr, a pointer into the skb head, from\nip6_find_1stfragopt(), then calls skb_checksum_help().  For a cloned skb\nskb_checksum_help() reallocates the head via pskb_expand_head(), leaving\nprevhdr dangling.  It is later dereferenced in ip6_frag_next(), causing a\nuse-after-free write.\n\nSave prevhdr's offset before skb_checksum_help() and recompute it after,\nlike commit ef0efcd3bd3f (\"ipv6: Fix dangling pointer when ipv6\nfragment\").\n\n  BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)\n  Write of size 1 at addr ffff888013ff5016 by task exploit/141\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ip6_frag_next (net/ipv6/ip6_output.c:857)\n   br_ip6_fragment (net/ipv6/netfilter.c:212)\n   nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)\n   nf_hook_slow (net/netfilter/core.c:619)\n   br_forward_finish (net/bridge/br_forward.c:66)\n   __br_forward (net/bridge/br_forward.c:115)\n   maybe_deliver (net/bridge/br_forward.c:191)\n   br_flood (net/bridge/br_forward.c:245)\n   br_handle_frame_finish (net/bridge/br_input.c:229)\n   br_handle_frame (net/bridge/br_input.c:442)\n   ...\n   packet_sendmsg (net/packet/af_packet.c:3114)\n   ...\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt"}],"id":"CVE-2026-64554","lastModified":"2026-11-13T18:21:55.717","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:31.205965Z","version":"2.0.3"}}]},"published":"2026-07-27T21:17:08.437","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64556.json b/data/2026/CVE-2026-64556.json
index 0c9a6ee294..0300a815f5 100644
--- a/data/2026/CVE-2026-64556.json
+++ b/data/2026/CVE-2026-64556.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1d3e1102273f09180262496658e7eeed8a5a7b59","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"39358e856fb89e62e3c8d7389a2dc4ec33dbe90e","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"a2d5d3ee7b6e3953114726b1521e62123ab5b043","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"06ccef0434e98058ddae7bcebc901f93d22b7653","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"037a3c43edfb597665dd34457cd22b14692f2ba3","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context."}],"id":"CVE-2026-64556","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64556","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:33.956439Z","version":"2.0.3"}}]},"published":"2026-07-29T09:16:30.153","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1d3e1102273f09180262496658e7eeed8a5a7b59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-662"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1d3e1102273f09180262496658e7eeed8a5a7b59","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"39358e856fb89e62e3c8d7389a2dc4ec33dbe90e","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"a2d5d3ee7b6e3953114726b1521e62123ab5b043","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"06ccef0434e98058ddae7bcebc901f93d22b7653","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"},{"lessThan":"037a3c43edfb597665dd34457cd22b14692f2ba3","status":"affected","version":"2e498d0a74e5b88a6689ae1b811f247f91ff188e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.39","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0E910015-36A3-4AA3-A76B-E472A30CE301","versionEndExcluding":"6.1.191","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"38A8100E-2B1A-462F-AEE9-8901B870FEF2","versionEndExcluding":"6.12.96","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7","versionEndExcluding":"6.18.39","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6228DDD6-4557-4AA3-9F43-AB995D471E42","versionEndExcluding":"7.1.4","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context."}],"id":"CVE-2026-64556","lastModified":"2026-11-13T18:21:34.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64556","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:33.956439Z","version":"2.0.3"}}]},"published":"2026-07-29T09:16:30.153","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d3e1102273f09180262496658e7eeed8a5a7b59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-662"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64557.json b/data/2026/CVE-2026-64557.json
index 1025d3c117..0e7e90efe3 100644
--- a/data/2026/CVE-2026-64557.json
+++ b/data/2026/CVE-2026-64557.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b39298044e5534612511a2ff5de03ba5f6e7a820","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"8c37e4338c801ebb8cee52436c01c41e009f6e87","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"84e718b6a814edc84159361f9f454a4e92ae91ae","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"36da806f7fbaee56ad9e81859deec203f9728700","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"733e76e74e406c1d1ddc7369420dd8a47f48bb8a","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"6fef032af0092ed5ccb767239a9ac1bc38c08a40","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."}],"id":"CVE-2026-64557","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:36.931417Z","version":"2.0.3"}}]},"published":"2026-07-29T09:16:30.280","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b39298044e5534612511a2ff5de03ba5f6e7a820","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"8c37e4338c801ebb8cee52436c01c41e009f6e87","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"84e718b6a814edc84159361f9f454a4e92ae91ae","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"36da806f7fbaee56ad9e81859deec203f9728700","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"733e76e74e406c1d1ddc7369420dd8a47f48bb8a","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"},{"lessThan":"6fef032af0092ed5ccb767239a9ac1bc38c08a40","status":"affected","version":"8ffb929098a56939ac71509302eeab5b207bf262","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/bluetooth/l2cap.h","net/bluetooth/6lowpan.c","net/bluetooth/l2cap_core.c","net/bluetooth/l2cap_sock.c","net/bluetooth/smp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"238776A1-8C60-426B-96A1-3D968526E4C1","versionEndExcluding":"6.1.178","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7046B092-F810-4440-ACE6-60218518EECE","versionEndExcluding":"6.6.145","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"05880CF6-5AD2-44E9-853A-6CE8318E76A5","versionEndExcluding":"6.12.97","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the ->new_connection() op so the core, rather than the callback,\nowns the child channel's lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."}],"id":"CVE-2026-64557","lastModified":"2026-11-13T18:21:18.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64557","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:36.931417Z","version":"2.0.3"}}]},"published":"2026-07-29T09:16:30.280","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64558.json b/data/2026/CVE-2026-64558.json
index 4ba6981251..1dca627a3a 100644
--- a/data/2026/CVE-2026-64558.json
+++ b/data/2026/CVE-2026-64558.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_pckmo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02028a24e26d85262ab9c8fc4344e1f3503007fc","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"433e5e70cdc1edf382d28d08a885b22e2b98b7da","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"614aa0491c7a190556c2345dddee0b6f5ed90989","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"1ac287e2af9a9112fe271427ef45eceb26bce8b4","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_pckmo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."}],"id":"CVE-2026-64558","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:40.566840Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_pckmo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"02028a24e26d85262ab9c8fc4344e1f3503007fc","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"433e5e70cdc1edf382d28d08a885b22e2b98b7da","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"614aa0491c7a190556c2345dddee0b6f5ed90989","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"1ac287e2af9a9112fe271427ef45eceb26bce8b4","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_pckmo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D2FA72D-20C9-432C-AC3C-498C90F2B579","versionEndExcluding":"6.12.97","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."}],"id":"CVE-2026-64558","lastModified":"2026-11-13T18:20:53.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:40.566840Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64559.json b/data/2026/CVE-2026-64559.json
index f5d668303f..e1479b653f 100644
--- a/data/2026/CVE-2026-64559.json
+++ b/data/2026/CVE-2026-64559.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0a9e34ccbe772b8f321388cdbdf4f22b94e513e7","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"693bf91d4db134f9b1c2840c8e287eee3d993bac","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"7e7e03848c918aa0acad5ffd75d929e3afec1554","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n\nExplicitly check the buffer length request structure provided by\nuser-space and fail, if it exceeds the buffer size."}],"id":"CVE-2026-64559","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:43.749651Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0a9e34ccbe772b8f321388cdbdf4f22b94e513e7","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"693bf91d4db134f9b1c2840c8e287eee3d993bac","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"7e7e03848c918aa0acad5ffd75d929e3afec1554","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"},{"lessThan":"b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970","status":"affected","version":"8fcc231ce3bea12b78bb94b280cdc03cff342435","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/s390/crypto/pkey_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0D2FA72D-20C9-432C-AC3C-498C90F2B579","versionEndExcluding":"6.12.97","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67D87928-1419-4529-9201-42C059678CB4","versionEndExcluding":"6.18.40","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n\nExplicitly check the buffer length request structure provided by\nuser-space and fail, if it exceeds the buffer size."}],"id":"CVE-2026-64559","lastModified":"2026-11-13T18:20:34.927","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:43.749651Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64560.json b/data/2026/CVE-2026-64560.json
index 144905134d..9c232f6470 100644
--- a/data/2026/CVE-2026-64560.json
+++ b/data/2026/CVE-2026-64560.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/exit.c","kernel/signal.c","kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"67aa823e3e8c229c6d374df79c804f6721cb83b6","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"d8bcb28abad857f1415da7656f19b2ada90af04f","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"12a891c773aeb5823d63dbd0cb2ab931d6c21c9b","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"e74443f5db0037c556ef436fa64b88bf4ea08f83","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"6a7ecc25abe6f0fecc6e62a05096987200edbd02","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"ad1cafa1bdaa71da85d71cac053838bbe97852b6","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"920f893f735e92ba3a1cd9256899a186b161928d","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/exit.c","kernel/signal.c","kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.262","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.213","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.180","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.147","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.100","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.41","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n   posix_cpu_timer_del()\n   // Observes old leader\n   p = pid_task(pid, pid_type);\t\tde_thread()\n   \t\t\t\t\t  switch_leader();\n\t\t\t\t\t  release_task(old_leader)\n\t\t\t\t\t    __exit_signal(old_leader)\n\t\t\t\t\t      sighand = lock(old_leader, sighand);\n\t\t\t\t\t      posix_cpu_timers*_exit();\n   sighand = lock_task_sighand(p)\t      unhash_task(old_leader);\n     sh = lock(p, sighand)\t    \t      old_leader->sighand = NULL;\n\t\t\t\t\t      unlock(sighand);\n     (p->sighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n   // Returns without action\n   if(!sighand)\n      return 0;\n   free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np->signal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object's timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it's the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n   posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t  posix_cpu_timers*_exit(p);\n\t\t\t\t\t  unhash_task(p);\n\t\t\t\t\t  p->sighand = NULL;\n     sh = lock_task_sighand(p)\n        sighand = p->sighand;\n\tif (!sighand)\n\t    return NULL;\n\tlock(sighand);\n\n     if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p->sighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n  1) Changing the store in __exit_signal() to smp_store_release().\n\n  2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n     of lock_task_sighand().\n\n  3) Creating a helper function for looking up the task and locking sighand\n     which does not return when sighand == NULL. Instead it retries the\n     task lookup and only if that fails it gives up.\n\n  4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that's the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---"}],"id":"CVE-2026-64560","lastModified":"2026-11-10T13:19:37.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:46.237776Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/exit.c","kernel/signal.c","kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"67aa823e3e8c229c6d374df79c804f6721cb83b6","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"d8bcb28abad857f1415da7656f19b2ada90af04f","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"12a891c773aeb5823d63dbd0cb2ab931d6c21c9b","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"e74443f5db0037c556ef436fa64b88bf4ea08f83","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"6a7ecc25abe6f0fecc6e62a05096987200edbd02","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"ad1cafa1bdaa71da85d71cac053838bbe97852b6","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"},{"lessThan":"920f893f735e92ba3a1cd9256899a186b161928d","status":"affected","version":"55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/exit.c","kernel/signal.c","kernel/time/posix-cpu-timers.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.262","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.213","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.180","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.147","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.100","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.41","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1652ADF5-2817-4084-9F5C-DBE333A9D34F","versionEndExcluding":"5.10.262","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A05396E1-62A0-4BBD-922D-EF85C5D66F1D","versionEndExcluding":"5.15.213","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"798ED9B9-3977-4673-A592-D65B38D04AF2","versionEndExcluding":"6.1.180","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91FB3913-C716-4D22-9FCE-96E1DC98035B","versionEndExcluding":"6.6.147","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0B9803FD-6C43-43DD-BFE2-DF31368E0709","versionEndExcluding":"6.12.100","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"536ED3FF-1C71-4CCF-A0F1-992A65E7DDB3","versionEndExcluding":"6.18.41","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FE149C35-43CC-473B-86E3-978E6A9CBC55","versionEndExcluding":"7.1.5","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n   posix_cpu_timer_del()\n   // Observes old leader\n   p = pid_task(pid, pid_type);\t\tde_thread()\n   \t\t\t\t\t  switch_leader();\n\t\t\t\t\t  release_task(old_leader)\n\t\t\t\t\t    __exit_signal(old_leader)\n\t\t\t\t\t      sighand = lock(old_leader, sighand);\n\t\t\t\t\t      posix_cpu_timers*_exit();\n   sighand = lock_task_sighand(p)\t      unhash_task(old_leader);\n     sh = lock(p, sighand)\t    \t      old_leader->sighand = NULL;\n\t\t\t\t\t      unlock(sighand);\n     (p->sighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n   // Returns without action\n   if(!sighand)\n      return 0;\n   free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np->signal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object's timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it's the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n   posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t  posix_cpu_timers*_exit(p);\n\t\t\t\t\t  unhash_task(p);\n\t\t\t\t\t  p->sighand = NULL;\n     sh = lock_task_sighand(p)\n        sighand = p->sighand;\n\tif (!sighand)\n\t    return NULL;\n\tlock(sighand);\n\n     if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p->sighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n  1) Changing the store in __exit_signal() to smp_store_release().\n\n  2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n     of lock_task_sighand().\n\n  3) Creating a helper function for looking up the task and locking sighand\n     which does not return when sighand == NULL. Instead it retries the\n     task lookup and only if that fails it gives up.\n\n  4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that's the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---"}],"id":"CVE-2026-64560","lastModified":"2026-11-13T18:20:08.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64560","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:46.237776Z","version":"2.0.3"}}]},"published":"2026-07-29T17:16:53.637","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64561.json b/data/2026/CVE-2026-64561.json
index aef1950cce..f1584bbf08 100644
--- a/data/2026/CVE-2026-64561.json
+++ b/data/2026/CVE-2026-64561.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62ef67af1878fa2cd066642f2f59e33ade95f637","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"65c4f7a1028cf01a93a2762d679c289810ede990","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"35e77467610c4a37cb0ff54ee56b85f73b1f5700","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"0026dbb7de8ea76e97d6edf42fc3cc084564e2bf","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"f3477a6a4164f15287444eda685b5f6405dbd1e5","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"bce0d3c26e2c761a4bf43c8949f333fc7374eb2d","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"2abd5287f08319fa35764566b15c6e22cb1068db","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.218","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."}],"id":"CVE-2026-64561","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:48.794184Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:30.937","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62ef67af1878fa2cd066642f2f59e33ade95f637"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://github.com/V4bel/Zapscape"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"62ef67af1878fa2cd066642f2f59e33ade95f637","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"65c4f7a1028cf01a93a2762d679c289810ede990","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"35e77467610c4a37cb0ff54ee56b85f73b1f5700","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"0026dbb7de8ea76e97d6edf42fc3cc084564e2bf","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"f3477a6a4164f15287444eda685b5f6405dbd1e5","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"bce0d3c26e2c761a4bf43c8949f333fc7374eb2d","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"},{"lessThan":"2abd5287f08319fa35764566b15c6e22cb1068db","status":"affected","version":"f95eec9bed76d42194c23153cb1cc8f186bf91cb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/mmu/mmu.c","arch/x86/kvm/mmu/paging_tmpl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.218","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"194705E6-4F9C-4542-A6DD-3E6E795DF121","versionEndExcluding":"5.15.218","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6391AD0C-FE0C-4D09-8ACA-C9F7979254AE","versionEndExcluding":"6.6.148","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4402C34-0450-4C2E-B4BF-63320A4A4FF9","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc4:*:*:*:*:*:*","matchCriteriaId":"8FAEA5EF-B1E7-4023-9E7A-90DE11D91F2B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU.  If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root.  On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent's role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM's invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can't be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."}],"id":"CVE-2026-64561","lastModified":"2026-11-13T18:19:00.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64561","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:48.794184Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:30.937","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/62ef67af1878fa2cd066642f2f59e33ade95f637"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Exploit","Technical Description","Third Party Advisory"],"url":"https://github.com/V4bel/Zapscape"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64562.json b/data/2026/CVE-2026-64562.json
index ca5004888c..17cd06891b 100644
--- a/data/2026/CVE-2026-64562.json
+++ b/data/2026/CVE-2026-64562.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b82c3144d8264265448292ca406f60bafeba3b6f","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"4f50e6aec16f69627dbad5704d1e90a255d766a7","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"dc3eecfa219ebc9d01eaf7d1abd1441efe884dab","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"af56298e9d86e6098cd1d2e155cb2949b7c45412","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"589419470030a89f16cf19300658b6dc644ca946","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"8001d2ce9d9bd09118ce523aef595aa094573ae3","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"1dabef6e206568bf9d9ade74f6e56a48ea35695d","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"622ebfac01ba4f9c0060cebd41257fe46fc4a0b3","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed."}],"id":"CVE-2026-64562","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:52.528075Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.093","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b82c3144d8264265448292ca406f60bafeba3b6f","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"4f50e6aec16f69627dbad5704d1e90a255d766a7","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"dc3eecfa219ebc9d01eaf7d1abd1441efe884dab","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"af56298e9d86e6098cd1d2e155cb2949b7c45412","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"589419470030a89f16cf19300658b6dc644ca946","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"8001d2ce9d9bd09118ce523aef595aa094573ae3","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"1dabef6e206568bf9d9ade74f6e56a48ea35695d","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"},{"lessThan":"622ebfac01ba4f9c0060cebd41257fe46fc4a0b3","status":"affected","version":"355f4fb1405ec29d0fac49b4d41fcd78cbd455d5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/vmx/nested.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"649BBE7B-E300-4522-BEF2-9744B42E9E24","versionEndExcluding":"5.10.265","versionStartIncluding":"4.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E53EBB9F-3754-42D9-9B1B-A16E73848ED3","versionEndExcluding":"5.15.216","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6391AD0C-FE0C-4D09-8ACA-C9F7979254AE","versionEndExcluding":"6.6.148","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4402C34-0450-4C2E-B4BF-63320A4A4FF9","versionEndExcluding":"6.12.101","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:-:*:*:*:*:*:*","matchCriteriaId":"592761F7-6672-484E-8490-1187F4CDD13E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:rc4:*:*:*:*:*:*","matchCriteriaId":"FE21670A-9B31-4AED-93C4-171286BB2A56","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:rc5:*:*:*:*:*:*","matchCriteriaId":"059DF035-9B5B-4F84-8EDD-34534ECAA579","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:rc6:*:*:*:*:*:*","matchCriteriaId":"B0288B1E-67AB-40F4-98C7-8C686510F664","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:rc7:*:*:*:*:*:*","matchCriteriaId":"73A5C6E1-051D-4FDC-8034-BE2896C639F3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:rc8:*:*:*:*:*:*","matchCriteriaId":"F96570B2-47BE-4DEF-AAD8-909913366EA0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc4:*:*:*:*:*:*","matchCriteriaId":"8FAEA5EF-B1E7-4023-9E7A-90DE11D91F2B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed."}],"id":"CVE-2026-64562","lastModified":"2026-11-13T18:18:19.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:52.528075Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.093","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64563.json b/data/2026/CVE-2026-64563.json
index 6c5916cd09..42bd284f15 100644
--- a/data/2026/CVE-2026-64563.json
+++ b/data/2026/CVE-2026-64563.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ba510b5e9fe396497d31162acb579f210adfe6c8","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"a0406c40c6638c5ae50257db6297b2fba6c9ba16","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"0955b65c2b47c30b439e2cf1b1e375073aa0413a","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.151","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.103","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table\nand sets iter->p = NULL if the object is gone.  When iter->walker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter->p.\n\nrhashtable_walk_next() then dereferences the stale iter->p, reading\nfreed memory.  This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n  Call Trace:\n   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n   netlink_diag_dump+0xc2/0x240\n   netlink_dump+0x5bc/0x1270\n   netlink_recvmsg+0x7a3/0x980\n   sock_recvmsg+0x1bc/0x200\n   __sys_recvfrom+0x1d4/0x2c0"}],"id":"CVE-2026-64563","lastModified":"2026-11-03T18:15:39.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:55.008845Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.220","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ba510b5e9fe396497d31162acb579f210adfe6c8","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"a0406c40c6638c5ae50257db6297b2fba6c9ba16","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"0955b65c2b47c30b439e2cf1b1e375073aa0413a","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"},{"lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","status":"affected","version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.151","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.103","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0E40530C-8F33-4A6E-B0F9-AA600BCD1DEA","versionEndExcluding":"5.10.265","versionStartIncluding":"4.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E53EBB9F-3754-42D9-9B1B-A16E73848ED3","versionEndExcluding":"5.15.216","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"621B79C8-2F65-4565-991D-62AAE146B524","versionEndExcluding":"6.1.183","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"498D2688-3298-4661-94EA-2FB8599B1134","versionEndExcluding":"6.6.151","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"09440D6A-32F9-4ADD-BB51-29CBF62DEB58","versionEndExcluding":"6.12.103","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1CD263AE-3BD4-43F3-AF24-6BA22541E0C2","versionEndExcluding":"6.18.42","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D275C711-FF65-4C57-BA4D-CD9B5D7BF0A3","versionEndExcluding":"7.1.6","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*","matchCriteriaId":"5E8B9085-7ADB-4A05-89EF-12949B6A0509","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:*","matchCriteriaId":"1FC0D50D-9D58-4947-A197-A5A3FF07E7E3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc3:*:*:*:*:*:*","matchCriteriaId":"D6ECA620-8606-4230-A87D-3FF3EFE12592","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.2:rc4:*:*:*:*:*:*","matchCriteriaId":"8FAEA5EF-B1E7-4023-9E7A-90DE11D91F2B","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table\nand sets iter->p = NULL if the object is gone.  When iter->walker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter->p.\n\nrhashtable_walk_next() then dereferences the stale iter->p, reading\nfreed memory.  This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n  Call Trace:\n   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n   netlink_diag_dump+0xc2/0x240\n   netlink_dump+0x5bc/0x1270\n   netlink_recvmsg+0x7a3/0x980\n   sock_recvmsg+0x1bc/0x200\n   __sys_recvfrom+0x1d4/0x2c0"}],"id":"CVE-2026-64563","lastModified":"2026-11-13T18:17:55.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:42:55.008845Z","version":"2.0.3"}}]},"published":"2026-08-04T07:16:31.220","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64666.json b/data/2026/CVE-2026-64666.json
index ced50d2804..87abd7deb2 100644
--- a/data/2026/CVE-2026-64666.json
+++ b/data/2026/CVE-2026-64666.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64666","lastModified":"2026-11-12T19:05:35.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T05:19:50.700","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/410"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/417"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"pam_usb","vendor":"mcdope","versions":[{"status":"affected","version":"< 0.9.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). When pam_usb.so loads into a setuid PAM host, the calling user controls the environment passed in. Clearing XRDP_SESSION before invoking the host bypasses the explicit XRDP-deny rule. Other remote-detection signals (rmsvc, evdev, loginctl, utmp) may still catch the session, but the env-based detection alone is defeated. This issue has been patched in version 0.9.3."}],"id":"CVE-2026-64666","lastModified":"2026-11-13T17:17:34.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:03:41.986185Z","version":"2.0.3"}}]},"published":"2026-11-11T05:19:50.700","references":[{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/commit/0b179ed679d6522c6a571c5a8ae9bdc7edbad31f"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/issues/410"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/pull/417"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/releases/tag/0.9.3"},{"source":"security-advisories@github.com","url":"https://github.com/mcdope/pam_usb/security/advisories/GHSA-ffx6-xjp6-x33g"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-64858.json b/data/2026/CVE-2026-64858.json
index 6f61c4fa01..188c718ac2 100644
--- a/data/2026/CVE-2026-64858.json
+++ b/data/2026/CVE-2026-64858.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"vulnerability-operator","vendor":"ckotzbauer","versions":[{"status":"affected","version":"< 0.28.16"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16."}],"id":"CVE-2026-64858","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T18:19:47.770","references":[{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae"},{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16"},{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-548"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"vulnerability-operator","vendor":"ckotzbauer","versions":[{"status":"affected","version":"< 0.28.16"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.FileServer over the reports directory (default /reports) with no authentication, authorization, or middleware. Any client that can reach the operator's HTTP port (default 8080) can list and download every JSON vulnerability report, disclosing CVE IDs, affected package names/versions, and container image identifiers for every workload scanned in the cluster. This issue has been patched in version 0.28.16."}],"id":"CVE-2026-64858","lastModified":"2026-11-13T18:17:48.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-64858","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:20:49.501533Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:47.770","references":[{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/commit/b083ab0146e7fb301be6b5a4bc917b5e5fad6eae"},{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/releases/tag/0.28.16"},{"source":"security-advisories@github.com","url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/ckotzbauer/vulnerability-operator/security/advisories/GHSA-6v6c-4cxg-cc93"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-548"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-68982.json b/data/2026/CVE-2026-68982.json
index 0345bc12dc..232da56870 100644
--- a/data/2026/CVE-2026-68982.json
+++ b/data/2026/CVE-2026-68982.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it."}],"id":"CVE-2026-68982","lastModified":"2026-11-12T15:17:51.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68982","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T15:05:24.911063Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.123","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/71192"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2020-11981"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://pypi.python.org","defaultStatus":"unaffected","packageName":"apache-airflow-core","packageURL":"pkg:pypi/apache-airflow-core","product":"Apache Airflow","vendor":"Apache Software Foundation","versions":[{"lessThan":"3.4.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without validating the workload's authentication token. Anyone able to write to the Celery broker could enqueue a forged callback and execute arbitrary code on every CeleryExecutor worker, without Airflow credentials. Deployments using the CeleryExecutor are affected.\n\nUsers are advised to upgrade to apache-airflow 3.4.0 or later, in which the worker claims the callback through the Execution API, validating the token, before running it."}],"id":"CVE-2026-68982","lastModified":"2026-11-13T18:17:48.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-68982","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:06:58.098402Z","version":"2.0.3"}}]},"published":"2026-11-09T10:17:11.123","references":[{"source":"security@apache.org","url":"https://github.com/apache/airflow/pull/71192"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/7t514l87nhjworv2ns22b8ltxr1f7rhg"},{"source":"security@apache.org","url":"https://www.cve.org/CVERecord?id=CVE-2020-11981"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"security@apache.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-76078.json b/data/2026/CVE-2026-76078.json
index cef854ebad..8e16a39632 100644
--- a/data/2026/CVE-2026-76078.json
+++ b/data/2026/CVE-2026-76078.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.224.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required: PRESENT) @sessionOnly — any self-provisioned trust center identity can call them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent build the tenant scope from the client-supplied signatureId GID (coredata.NewScopeFromObjectID(req.SignatureID)) and load the signature by that GID. At no point do they verify that the signature belongs to the caller or that the caller's email matches the signature's SignerEmail. As a result, any authenticated trust-center visitor who possesses another visitor's signature GID can: (1) complete that visitor's NDA signature — overwriting signer name/IP/UA with attacker data and setting status to Accepted, which triggers the sealing worker to generate a completion certificate; (2) inject arbitrary audit-trail events into any signature's log. Both attacks defeat the non-repudiation and integrity guarantees of the e-signature system. This issue has been patched in version 0.224.0."}],"id":"CVE-2026-76078","lastModified":"2026-11-11T19:17:44.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T19:17:44.550","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/f20c3d73d20fcce1344ee1a44bfa6d7f8c35471f"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1475"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-22xj-f767-ppw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"product":"probo","vendor":"getprobo","versions":[{"status":"affected","version":"< 0.224.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required: PRESENT) @sessionOnly — any self-provisioned trust center identity can call them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent build the tenant scope from the client-supplied signatureId GID (coredata.NewScopeFromObjectID(req.SignatureID)) and load the signature by that GID. At no point do they verify that the signature belongs to the caller or that the caller's email matches the signature's SignerEmail. As a result, any authenticated trust-center visitor who possesses another visitor's signature GID can: (1) complete that visitor's NDA signature — overwriting signer name/IP/UA with attacker data and setting status to Accepted, which triggers the sealing worker to generate a completion certificate; (2) inject arbitrary audit-trail events into any signature's log. Both attacks defeat the non-repudiation and integrity guarantees of the e-signature system. This issue has been patched in version 0.224.0."}],"id":"CVE-2026-76078","lastModified":"2026-11-13T18:17:49.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-76078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:27:04.364183Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:44.550","references":[{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/eb9274f2cd7101f89c21c18f6d7a3570f95aff32"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/commit/f20c3d73d20fcce1344ee1a44bfa6d7f8c35471f"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/pull/1475"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/releases/tag/probod%2Fv0.224.0"},{"source":"security-advisories@github.com","url":"https://github.com/getprobo/probo/security/advisories/GHSA-22xj-f767-ppw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-78162.json b/data/2026/CVE-2026-78162.json
index b3950027c9..1b7ab17802 100644
--- a/data/2026/CVE-2026-78162.json
+++ b/data/2026/CVE-2026-78162.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.camel:camel-hazelcast","packageURL":"pkg:maven/org.apache.camel/camel-hazelcast","product":"Apache Camel","vendor":"Apache Software Foundation","versions":[{"lessThan":"4.18.5","status":"affected","version":"4.0.0","versionType":"maven"},{"lessThan":"4.22.1","status":"affected","version":"4.19.0","versionType":"maven"},{"status":"unaffected","version":"4.18.5","versionType":"maven"},{"status":"unaffected","version":"4.22.1","versionType":"maven"},{"status":"unaffected","version":"4.23.0","versionType":"maven"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","matchCriteriaId":"DE11AE1E-E378-4412-9E7F-377077C43A9F","versionEndExcluding":"4.18.5","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","matchCriteriaId":"210D0283-161A-490D-94D0-F30E47ED17D2","versionEndExcluding":"4.22.1","versionStartIncluding":"4.19.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel. Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster."}],"id":"CVE-2026-78162","lastModified":"2026-11-03T14:47:51.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-78162","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-19T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-10-19T11:17:19.037","references":[{"source":"security@apache.org","tags":["Mitigation","Patch","Vendor Advisory","Not Applicable"],"url":"https://camel.apache.org/security/CVE-2026-43865.html"},{"source":"security@apache.org","tags":["Mitigation","Patch","Vendor Advisory"],"url":"https://camel.apache.org/security/CVE-2026-78162.html"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25566"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25595"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25599"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25600"},{"source":"security@apache.org","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://issues.apache.org/jira/browse/CAMEL-24413"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://issues.apache.org/jira/browse/CAMEL-24420"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.camel:camel-hazelcast","packageURL":"pkg:maven/org.apache.camel/camel-hazelcast","product":"Apache Camel","vendor":"Apache Software Foundation","versions":[{"lessThan":"4.18.5","status":"affected","version":"4.0.0","versionType":"maven"},{"lessThan":"4.22.1","status":"affected","version":"4.19.0","versionType":"maven"},{"status":"unaffected","version":"4.18.5","versionType":"maven"},{"status":"unaffected","version":"4.22.1","versionType":"maven"},{"status":"unaffected","version":"4.23.0","versionType":"maven"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","matchCriteriaId":"DE11AE1E-E378-4412-9E7F-377077C43A9F","versionEndExcluding":"4.18.5","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*","matchCriteriaId":"210D0283-161A-490D-94D0-F30E47ED17D2","versionEndExcluding":"4.22.1","versionStartIncluding":"4.19.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of Untrusted Data vulnerability in Apache Camel.\n\n\n\nThis issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nThe camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a protection introduced by CVE-2026-43865. That change did not reach two of the configuration paths Camel builds itself, so those paths continued to create Hazelcast instances whose Java deserialization is unrestricted. ReplicatedHazelcastAggregationRepository extends HazelcastAggregationRepository but overrides doStart() without calling super.doStart(), keeping its own copy of the bootstrap block, and therefore never received the filter: a route using it without supplying a hazelcastInstance starts a Hazelcast member that deserializes values read from the backing ReplicatedMap with no class restriction. HazelcastDefaultComponent#getOrCreateHzClientInstance() builds its own ClientConfig when hazelcastMode=client is selected and neither a referenced ClientConfig nor hazelcastConfigUri is supplied, and likewise applied no filter, so client-mode endpoints behaved differently from node-mode endpoints for an otherwise identical configuration. In both cases an attacker able to publish into the Hazelcast cluster that the affected instance is attached to can cause a serialized Java object of their choosing to be deserialized inside Hazelcast's own serialization layer, before Camel processes the exchange, resulting in remote code execution. Hazelcast clusters have neither authentication nor TLS enabled by default. Selecting client mode is a topology choice rather than a security option, so neither path required the deployment to opt in to unsafe behaviour.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, supply an explicit Hazelcast configuration carrying a JavaSerializationFilterConfig, or inject a pre-built HazelcastInstance, since a user-supplied configuration is never overwritten by Camel. Alternatively set the JVM-wide filter -Djdk.serialFilter=!java.net.;java.;javax.;org.apache.camel.;!* and enable Hazelcast cluster authentication and TLS to restrict who can reach the cluster."}],"id":"CVE-2026-78162","lastModified":"2026-11-13T17:17:34.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@apache.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-78162","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-20T03:55:29.887531Z","version":"2.0.3"}}]},"published":"2026-10-19T11:17:19.037","references":[{"source":"security@apache.org","tags":["Mitigation","Not Applicable","Patch","Vendor Advisory"],"url":"https://camel.apache.org/security/CVE-2026-43865.html"},{"source":"security@apache.org","tags":["Mitigation","Patch","Vendor Advisory"],"url":"https://camel.apache.org/security/CVE-2026-78162.html"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25566"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25595"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25599"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://github.com/apache/camel/pull/25600"},{"source":"security@apache.org","tags":["Issue Tracking","Patch","Vendor Advisory"],"url":"https://issues.apache.org/jira/browse/CAMEL-24413"},{"source":"security@apache.org","tags":["Issue Tracking","Patch"],"url":"https://issues.apache.org/jira/browse/CAMEL-24420"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"security@apache.org","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-81668.json b/data/2026/CVE-2026-81668.json
index b4e86db6bf..e2f1f37492 100644
--- a/data/2026/CVE-2026-81668.json
+++ b/data/2026/CVE-2026-81668.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.14.0.24-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.14.0.24-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.16.0.23-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"katello","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration."}],"id":"CVE-2026-81668","lastModified":"2026-11-13T02:18:59.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-81668","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-27T14:27:31.227878Z","version":"2.0.3"}}]},"published":"2026-08-27T13:18:42.463","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-81668"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524928"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.14.0.24-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.14.0.24-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.16.0.23-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"rubygem-katello","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.20.0.12-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"katello","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration."}],"id":"CVE-2026-81668","lastModified":"2026-11-13T17:17:34.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-81668","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-27T14:27:31.227878Z","version":"2.0.3"}}]},"published":"2026-08-27T13:18:42.463","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-81668"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524928"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-82175.json b/data/2026/CVE-2026-82175.json
index 5e55df384c..06308d7d1a 100644
--- a/data/2026/CVE-2026-82175.json
+++ b/data/2026/CVE-2026-82175.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance."}],"id":"CVE-2026-82175","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T15:17:56.350","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance."}],"id":"CVE-2026-82175","lastModified":"2026-11-13T17:17:35.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":2.5,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:00:55.638874Z","version":"2.0.3"}}]},"published":"2026-11-13T15:17:56.350","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-82177.json b/data/2026/CVE-2026-82177.json
index 591933c719..0f8812ebc4 100644
--- a/data/2026/CVE-2026-82177.json
+++ b/data/2026/CVE-2026-82177.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T16:05:57.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PowerStore 500T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 3200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200Q","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 7000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9000T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9200T","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 1500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 5500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"PowerStore 9500","vendor":"Dell","versions":[{"lessThan":"5.1.0.0-2798105 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerability, potentially leading to arbitrary root command execution on the appliance."}],"id":"CVE-2026-82177","lastModified":"2026-11-13T17:17:35.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-82177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:05:12.337571Z","version":"2.0.3"}}]},"published":"2026-11-13T14:18:00.503","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000527640/dsa-2026-479-dell-powerstore-t-security-update-for-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86322.json b/data/2026/CVE-2026-86322.json
index a2c1bb03c7..17ad9ff855 100644
--- a/data/2026/CVE-2026-86322.json
+++ b/data/2026/CVE-2026-86322.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts."}],"id":"CVE-2026-86322","lastModified":"2026-11-13T00:20:18.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T21:17:33.057","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529289"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.19-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another user’s ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts."}],"id":"CVE-2026-86322","lastModified":"2026-11-13T17:17:35.363","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T21:17:33.057","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86322"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529289"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86323.json b/data/2026/CVE-2026-86323.json
index 9bde48cafe..a45821e4ac 100644
--- a/data/2026/CVE-2026-86323.json
+++ b/data/2026/CVE-2026-86323.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user."}],"id":"CVE-2026-86323","lastModified":"2026-11-13T16:19:34.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:39:28.245266Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:33.223","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529290"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.19-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that user’s notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another user’s mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user."}],"id":"CVE-2026-86323","lastModified":"2026-11-13T17:17:35.487","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:39:28.245266Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:33.223","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86323"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529290"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86324.json b/data/2026/CVE-2026-86324.json
index 67b815d2a7..720fe7d266 100644
--- a/data/2026/CVE-2026-86324.json
+++ b/data/2026/CVE-2026-86324.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts."}],"id":"CVE-2026-86324","lastModified":"2026-11-13T02:18:59.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-12T21:17:33.390","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86324"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529291"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el8sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.12.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.14.0.26-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.16.0.29-1.el9sat","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"foreman","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.18.0.19-1.el9sat","versionType":"rpm"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another user’s ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victim’s managed hosts."}],"id":"CVE-2026-86324","lastModified":"2026-11-13T17:17:35.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86324","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T15:28:45.651295Z","version":"2.0.3"}}]},"published":"2026-11-12T21:17:33.390","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-86324"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529291"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-86363.json b/data/2026/CVE-2026-86363.json
index 42f611c141..f3555e1766 100644
--- a/data/2026/CVE-2026-86363.json
+++ b/data/2026/CVE-2026-86363.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.13.330 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86363","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:50.837","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-329"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Live Optics Collector","vendor":"Dell","versions":[{"lessThan":"27.3.13.330 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure."}],"id":"CVE-2026-86363","lastModified":"2026-11-13T18:17:49.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-86363","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:19:15.023293Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:50.837","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-329"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-89324.json b/data/2026/CVE-2026-89324.json
index 2932e7187d..560617abd8 100644
--- a/data/2026/CVE-2026-89324.json
+++ b/data/2026/CVE-2026-89324.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Basel Post Types","vendor":"XTemos","versions":[{"lessThanOrEqual":"1.18","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings."}],"id":"CVE-2026-89324","lastModified":"2026-11-10T22:21:14.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-10T22:21:14.003","references":[{"source":"security@wordfence.com","url":"https://themeforest.net/item/basel-responsive-ecommerce-theme/14906749"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a04176-cec2-4723-a5c6-23ca2ea6ef97?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Basel Post Types","vendor":"XTemos","versions":[{"lessThanOrEqual":"1.18","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT inside BASEL_Auth::get_config() causes PHP to evaluate the constant's value rather than its name, making the check always fail and permanently falling back to the static hardcoded salt 2NlBUibcszrVtNmDnxqDbwCOpLWq91eatIz6O1O that is publicly visible in the theme source code; because this salt is static and known, an attacker can compute a valid Opauth signature entirely offline and submit a forged ?opauth callback to the unauthenticated init hook endpoint processed by register_or_login. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, by forging a callback tied to a known target account email address — bypassing all password verification, multi-factor authentication, and ownership checks, and receiving a fully authenticated session cookie via wc_set_customer_auth_cookie(). Exploitation requires WooCommerce to be active and at least one Basel social-login provider (Facebook, Google, or VKontakte) to be configured with a valid app_id and app_secret in the theme settings."}],"id":"CVE-2026-89324","lastModified":"2026-11-13T17:17:35.877","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-89324","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:28:27.095710Z","version":"2.0.3"}}]},"published":"2026-11-10T22:21:14.003","references":[{"source":"security@wordfence.com","url":"https://themeforest.net/item/basel-responsive-ecommerce-theme/14906749"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/40a04176-cec2-4723-a5c6-23ca2ea6ef97?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security@wordfence.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-90959.json b/data/2026/CVE-2026-90959.json
index b559160e4d..98bdc80341 100644
--- a/data/2026/CVE-2026-90959.json
+++ b/data/2026/CVE-2026-90959.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.71-1.el9ap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.63.21-4.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.63.21-4.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.73.45-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.73.45-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791947385","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2.7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792388670","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python3.11-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python3x-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"pulpcore-obsolete-packages","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"rubygem-pulpcore_client","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry."}],"id":"CVE-2026-90959","lastModified":"2026-11-13T00:20:18.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-25T17:47:33.555341Z","version":"2.0.3"}}]},"published":"2026-09-24T15:17:53.540","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87004"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87124"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-90959"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533037"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.71-1.el9ap","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el8pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.16::el8","cpe:/a:redhat:satellite:6.16::el9","cpe:/a:redhat:satellite_capsule:6.16::el8","cpe:/a:redhat:satellite_capsule:6.16::el9","cpe:/a:redhat:satellite_utils:6.16::el8","cpe:/a:redhat:satellite_utils:6.16::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.16 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.49.39-5.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.63.21-4.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.17::el9","cpe:/a:redhat:satellite_capsule:6.17::el9","cpe:/a:redhat:satellite_maintenance:6.17::el9","cpe:/a:redhat:satellite_utils:6.17::el9"],"defaultStatus":"affected","packageName":"python-pulpcore","product":"Red Hat Satellite 6.17 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.63.21-4.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.73.45-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.18::el9","cpe:/a:redhat:satellite_capsule:6.18::el9","cpe:/a:redhat:satellite_maintenance:6.18::el9","cpe:/a:redhat:satellite_utils:6.18::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.18 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.73.45-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.85.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.19::el9","cpe:/a:redhat:satellite_capsule:6.19::el9","cpe:/a:redhat:satellite_utils:6.19::el9"],"defaultStatus":"affected","packageName":"python3.12-pulpcore","product":"Red Hat Satellite 6.19 for RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.85.35-1.el9pc","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"defaultStatus":"affected","packageName":"ansible-automation-platform-26/hub-rhel9","product":"Red Hat Ansible Automation Platform 2.6","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1791947385","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"defaultStatus":"affected","packageName":"ansible-automation-platform-27/hub-rhel9","product":"Red Hat Ansible Automation Platform 2.7","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1792388670","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"ansible-automation-platform-24/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"affected","packageName":"ansible-automation-platform-25/hub-rhel8","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python3.11-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python3x-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Ansible Automation Platform 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"pulpcore-obsolete-packages","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"unaffected","packageName":"rubygem-pulpcore_client","product":"Red Hat Satellite 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"pulpcore-selinux","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:4::el8"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 4 for Cloud Providers","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"python-pulpcore-client","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"affected","packageName":"rhui5/rhua-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhui:5::el9"],"defaultStatus":"unaffected","packageName":"rhui5/rhua-tp-rhel9","product":"Red Hat Update Infrastructure 5","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry."}],"id":"CVE-2026-90959","lastModified":"2026-11-13T17:17:35.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-90959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-25T17:47:33.555341Z","version":"2.0.3"}}]},"published":"2026-09-24T15:17:53.540","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87004"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:87124"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99949"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99950"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99952"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-90959"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533037"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-91151.json b/data/2026/CVE-2026-91151.json
index f25c637abc..9f57bc2c2f 100644
--- a/data/2026/CVE-2026-91151.json
+++ b/data/2026/CVE-2026-91151.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}],"id":"CVE-2026-91151","lastModified":"2026-11-12T17:17:47.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}]},"published":"2026-11-11T20:17:10.557","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99599"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el10_3","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:310.10.2-1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:366.1.1-1.el9_9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream","cpe:/o:redhat:rhel_eus:9.8::baseos"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:356.4.1-1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"cockpit","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel10","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system."}],"id":"CVE-2026-91151","lastModified":"2026-11-13T18:17:49.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91151","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:39:58.197487Z","version":"2.0.3"}}]},"published":"2026-11-11T20:17:10.557","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99599"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99600"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99601"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99602"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99603"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-91151"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/commit/4796b28be064a90e32262cec85be7839e6198e23"},{"source":"secalert@redhat.com","url":"https://github.com/cockpit-project/cockpit/releases/tag/372"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478404"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-91873.json b/data/2026/CVE-2026-91873.json
index c37731471d..5b77d68d11 100644
--- a/data/2026/CVE-2026-91873.json
+++ b/data/2026/CVE-2026-91873.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91873","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:47.230","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"OpenManage Ansible Modules","vendor":"Dell","versions":[{"lessThan":"11.0.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfishAPI component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access."}],"id":"CVE-2026-91873","lastModified":"2026-11-13T18:17:49.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:34:26.653384Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:47.230","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515420/dsa-2026-432-security-update-for-dell-ansible-server-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-91890.json b/data/2026/CVE-2026-91890.json
index c0241042da..bcd713562a 100644
--- a/data/2026/CVE-2026-91890.json
+++ b/data/2026/CVE-2026-91890.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for Unity","vendor":"Dell","versions":[{"lessThan":"1.2.13 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access."}],"id":"CVE-2026-91890","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T18:19:53.627","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ansible Storage for Unity","vendor":"Dell","versions":[{"lessThan":"1.2.13 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnector component. An unauthenticated attacker with remote access could potentially exploit this vulnerability,leading to information exposure and unauthorized access."}],"id":"CVE-2026-91890","lastModified":"2026-11-13T18:17:49.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.8,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91890","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:22:45.476657Z","version":"2.0.3"}}]},"published":"2026-11-11T18:19:53.627","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-au/000515361/dsa-2026-431-security-update-for-dell-ansible-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-91892.json b/data/2026/CVE-2026-91892.json
index 6216c44387..1cb3cc8936 100644
--- a/data/2026/CVE-2026-91892.json
+++ b/data/2026/CVE-2026-91892.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91892","lastModified":"2026-11-12T18:44:24.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}]},"published":"2026-11-11T19:17:48.477","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-326"}],"source":"security_alert@emc.com","type":"Primary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Terraform Provider for PowerFlex","vendor":"Dell","versions":[{"lessThan":"1.9.0 or later","status":"affected","version":"0","versionType":"semver"}]}],"source":"security_alert@emc.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure."}],"id":"CVE-2026-91892","lastModified":"2026-11-13T18:17:49.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security_alert@emc.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-91892","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-13T17:24:49.358824Z","version":"2.0.3"}}]},"published":"2026-11-11T19:17:48.477","references":[{"source":"security_alert@emc.com","url":"https://www.dell.com/support/kbdoc/en-in/000515434/dsa-2026-433-security-update-for-dell-terraform-provider-for-dell-storage-multiple-vulnerabilities"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-326"}],"source":"security_alert@emc.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92544.json b/data/2026/CVE-2026-92544.json
index eee25f834b..0c7c0abbfc 100644
--- a/data/2026/CVE-2026-92544.json
+++ b/data/2026/CVE-2026-92544.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name."}],"id":"CVE-2026-92544","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]},"published":"2026-11-10T21:21:40.433","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kong Gateway Enterprise","vendor":"Kong Inc.","versions":[{"lessThan":"3.10.0.20","status":"affected","version":"3.10.0.0","versionType":"custom"},{"lessThan":"3.13.0.12","status":"affected","version":"3.13.0.0","versionType":"custom"},{"lessThan":"3.14.0.17","status":"affected","version":"3.14.0.0","versionType":"custom"},{"lessThan":"3.15.0.7","status":"affected","version":"3.15.0.0","versionType":"custom"},{"lessThan":"3.16.0.2","status":"affected","version":"3.16.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Kong AI Gateway","vendor":"Kong Inc.","versions":[{"lessThan":"2.2.1","status":"affected","version":"2.2.0","versionType":"custom"}]}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name."}],"id":"CVE-2026-92544","lastModified":"2026-11-13T17:17:36.250","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-13T16:40:44.837600Z","version":"2.0.3"}}]},"published":"2026-11-10T21:21:40.433","references":[{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/ai-gateway/changelog/"},{"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","url":"https://developer.konghq.com/gateway/changelog/"}],"sourceIdentifier":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92893.json b/data/2026/CVE-2026-92893.json
index 2ee7c9c67d..c8200cecf9 100644
--- a/data/2026/CVE-2026-92893.json
+++ b/data/2026/CVE-2026-92893.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-foreman_ansible","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."}],"id":"CVE-2026-92893","lastModified":"2026-09-18T19:06:08.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T12:39:18.653134Z","version":"2.0.3"}}]},"published":"2026-09-17T11:17:03.337","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92893"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535903"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-foreman_ansible","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary host IDs within their organization and receive the full Ansible inventory for those hosts, including parameter values marked as hidden."}],"id":"CVE-2026-92893","lastModified":"2026-11-13T18:17:49.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92893","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T12:39:18.653134Z","version":"2.0.3"}}]},"published":"2026-09-17T11:17:03.337","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92893"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535903"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-92904.json b/data/2026/CVE-2026-92904.json
index 54eb1e4aa1..8f4aaf7b24 100644
--- a/data/2026/CVE-2026-92904.json
+++ b/data/2026/CVE-2026-92904.json
@@ -1 +1 @@
-{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-foreman_remote_execution","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations."}],"id":"CVE-2026-92904","lastModified":"2026-09-18T19:06:08.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T14:43:46.493259Z","version":"2.0.3"}}]},"published":"2026-09-17T13:17:00.877","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92904"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535942"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
+{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6"],"defaultStatus":"affected","packageName":"rubygem-foreman_remote_execution","product":"Red Hat Satellite 6","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations."}],"id":"CVE-2026-92904","lastModified":"2026-11-13T18:17:49.853","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-92904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-17T14:43:46.493259Z","version":"2.0.3"}}]},"published":"2026-09-17T13:17:00.877","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:100120"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-92904"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535942"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"secalert@redhat.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-97357.json b/data/2026/CVE-2026-97357.json
new file mode 100644
index 0000000000..428f6c7f1c
--- /dev/null
+++ b/data/2026/CVE-2026-97357.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SpaceCom","vendor":"B. Braun Melsungen AG","versions":[{"lessThanOrEqual":"U/L94","status":"affected","version":"0","versionType":"custom"}]}],"source":"productsecurity@bbraun.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device."}],"id":"CVE-2026-97357","lastModified":"2026-11-13T18:17:49.977","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productsecurity@bbraun.com","type":"Secondary"}]},"published":"2026-11-13T18:17:49.977","references":[{"source":"productsecurity@bbraun.com","url":"https://https://www.bbraunusa.com/productsecurity"},{"source":"productsecurity@bbraun.com","url":"https://www.bbraun.com/productsecurity"}],"sourceIdentifier":"productsecurity@bbraun.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"productsecurity@bbraun.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-97358.json b/data/2026/CVE-2026-97358.json
new file mode 100644
index 0000000000..a7c7bd68bc
--- /dev/null
+++ b/data/2026/CVE-2026-97358.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SpaceCom","vendor":"B. Braun Melsungen AG","versions":[{"lessThanOrEqual":"U/L94","status":"affected","version":"0","versionType":"custom"}]}],"source":"productsecurity@bbraun.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom"}],"id":"CVE-2026-97358","lastModified":"2026-11-13T18:17:50.140","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productsecurity@bbraun.com","type":"Secondary"}]},"published":"2026-11-13T18:17:50.140","references":[{"source":"productsecurity@bbraun.com","url":"https://https://www.bbraunusa.com/productsecurity"},{"source":"productsecurity@bbraun.com","url":"https://www.bbraun.com/productsecurity"}],"sourceIdentifier":"productsecurity@bbraun.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-830"}],"source":"productsecurity@bbraun.com","type":"Secondary"}]}
diff --git a/data/2026/CVE-2026-97361.json b/data/2026/CVE-2026-97361.json
new file mode 100644
index 0000000000..1a2a48c1a2
--- /dev/null
+++ b/data/2026/CVE-2026-97361.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SpaceCom","vendor":"B. Braun Melsungen AG","versions":[{"lessThanOrEqual":"U/L94","status":"affected","version":"0","versionType":"custom"}]}],"source":"productsecurity@bbraun.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi."}],"id":"CVE-2026-97361","lastModified":"2026-11-13T18:17:50.283","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productsecurity@bbraun.com","type":"Secondary"}]},"published":"2026-11-13T18:17:50.283","references":[{"source":"productsecurity@bbraun.com","url":"https://www.bbraun.com/productsecurity"},{"source":"productsecurity@bbraun.com","url":"https://www.bbraunusa.com/productsecurity"}],"sourceIdentifier":"productsecurity@bbraun.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"productsecurity@bbraun.com","type":"Secondary"}]}
diff --git a/state/sync.json b/state/sync.json
index 9dff12bf46..df86f6c953 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1 +1 @@
-{"initial_complete":true,"last_run_counts":{"seen":5253,"skipped":39,"unchanged":4696,"written":518},"last_run_mode":"incremental","last_successful_end":"2026-11-13T16:42:55+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T16:48:08.840653+00:00"}
+{"initial_complete":true,"last_run_counts":{"seen":5375,"skipped":39,"unchanged":4909,"written":427},"last_run_mode":"incremental","last_successful_end":"2026-11-13T18:42:53+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-13T18:48:11.655634+00:00"}