VULN/vuln-nvd
1
0 Fork 0
Code Pull Requests Actions Activity

NVD update 2026-11-12T22:47:46Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-12 23:47:52 +01:00
1 parent ae9f25babe
commit e05d4ab377
889 files changed
+889 -859
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2017/CVE-2017-20251.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"Woody Code Snippets","vendor":"Themeisle","versions":[{"lessThan":"3.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server."},{"lang":"es","value":"Las versiones del plugin WordPress Insert PHP anteriores a la 3.3.1 contienen una vulnerabilidad de inyección de código PHP que permite a atacantes no autenticados ejecutar código PHP arbitrario inyectando shortcodes maliciosos a través de la API REST de WordPress. Los atacantes pueden enviar solicitudes POST al endpoint wp-json/wp/v2/posts con contenido manipulado que contenga shortcodes insert_php para incluir y ejecutar archivos PHP remotos en el servidor."}],"id":"CVE-2017-20251","lastModified":"2026-07-21T07:10:00.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2017-20251","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T16:13:44.753300Z","version":"2.0.3"}}]},"published":"2026-06-09T13:16:35.140","references":[{"source":"disclosure@vulncheck.com","url":"https://fr.wordpress.org/plugins/insert-php/"},{"source":"disclosure@vulncheck.com","url":"https://www.exploit-db.com/exploits/41308"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Woody Code Snippets","vendor":"Themeisle","versions":[{"lessThan":"2.5.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server."},{"lang":"es","value":"Las versiones del plugin WordPress Insert PHP anteriores a la 3.3.1 contienen una vulnerabilidad de inyección de código PHP que permite a atacantes no autenticados ejecutar código PHP arbitrario inyectando shortcodes maliciosos a través de la API REST de WordPress. Los atacantes pueden enviar solicitudes POST al endpoint wp-json/wp/v2/posts con contenido manipulado que contenga shortcodes insert_php para incluir y ejecutar archivos PHP remotos en el servidor."}],"id":"CVE-2017-20251","lastModified":"2026-11-12T22:17:32.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2017-20251","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T16:13:44.753300Z","version":"2.0.3"}}]},"published":"2026-06-09T13:16:35.140","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/insert-php/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.exploit-db.com/exploits/41308"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2022/CVE-2022-29966.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition."}],"id":"CVE-2022-29966","lastModified":"2026-11-06T19:17:01.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-29966","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:07:42.850084Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:20.353","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition."}],"id":"CVE-2022-29966","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-29966","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:07:42.850084Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:20.353","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
data/2022/CVE-2022-30267.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution."}],"id":"CVE-2022-30267","lastModified":"2026-11-06T19:17:01.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-30267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:06:59.602514Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:21.860","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution."}],"id":"CVE-2022-30267","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-30267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:06:59.602514Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:21.860","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]}
data/2024/CVE-2024-21963.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0k"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Series","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6 1.0.0.Ed"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bf"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7f"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1PI 1.0.0.3j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2.b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1m"}]},{"defaultSLine truncated
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0k"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Series","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6 1.0.0.Ed"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bf"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7f"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1PI 1.0.0.3j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2.b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1m"}]},{"defaultSLine truncated
data/2024/CVE-2024-36344.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.6"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5PI 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"},{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4PI 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMLine truncated
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.6"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5PI 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"},{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4PI 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMLine truncated
data/2024/CVE-2024-41786.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.2:*:*:*:*:*:*:*"],"product":"Engineering Requirements Management DOORS Next","vendor":"IBM","versions":[{"status":"affected","version":"7.1"},{"status":"affected","version":"7.2"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation."},{"lang":"es","value":"IBM Engineering Requirements Management DOORS Next 7.1 y 7.2 podría permitir a un atacante remoto forzar al servidor web a devolver el contenido de un archivo solicitado sensible debido a una validación de entrada incorrecta."}],"id":"CVE-2024-41786","lastModified":"2026-11-09T10:10:00.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T16:16:35.413","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294385"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-213"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.2:*:*:*:*:*:*:*"],"product":"Engineering Requirements Management DOORS Next","vendor":"IBM","versions":[{"status":"affected","version":"7.1"},{"status":"affected","version":"7.2"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation."},{"lang":"es","value":"IBM Engineering Requirements Management DOORS Next 7.1 y 7.2 podría permitir a un atacante remoto forzar al servidor web a devolver el contenido de un archivo solicitado sensible debido a una validación de entrada incorrecta."}],"id":"CVE-2024-41786","lastModified":"2026-11-12T21:17:15.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-41786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:10:38.575581Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.413","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294385"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-213"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2025/CVE-2025-0043.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."}],"id":"CVE-2025-0043","lastModified":"2026-11-12T20:18:13.827","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."}],"id":"CVE-2025-0043","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]}
data/2025/CVE-2025-10935.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-12T03:17:08.107","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]}
data/2025/CVE-2025-11229.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"7.0.0.125","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.32","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"WSO2 Identity Application Management Component","vendor":"WSO2","versions":[{"lessThan":"7.0.78.137","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThan":"7.8.23.49","status":"affected","version":"7.8.23","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.\n\nExploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state."},{"lang":"es","value":"El sistema no aplica correctamente la autorización de alcance cuando la configuración “authorize_all_scopes” está habilitada. Esto permite que las aplicaciones que utilizan el tipo de concesión de credenciales de cliente obtengan todos los alcances de la API, incluidos los alcances internos y de consola sensibles, sin requerir autorización explícita, eludiendo los controles de acceso previstos.\n\nLa explotación de esta vulnerabilidad puede conducir a una escalada de privilegios, permitiendo a los clientes sin privilegios realizar acciones administrativas no autorizadas, acceder a datos organizacionales confidenciales y, potencialmente, lograr una toma de control completa de la cuenta en implementaciones donde la configuración “authorize_all_scopes” se desvía de su estado deshabilitado predeterminado."}],"id":"CVE-2025-11229","lastModified":"2026-11-09T22:18:20.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:28:59.481681Z","version":"2.0.3"}}]},"published":"2026-11-04T06:16:54.070","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"7.0.0.125","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.32","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"WSO2 Identity Application Management Component","vendor":"WSO2","versions":[{"lessThan":"7.0.78.137","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThan":"7.8.23.49","status":"affected","version":"7.8.23","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.\n\nExploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state."},{"lang":"es","value":"El sistema no aplica correctamente la autorización de alcance cuando la configuración “authorize_all_scopes” está habilitada. Esto permite que las aplicaciones que utilizan el tipo de concesión de credenciales de cliente obtengan todos los alcances de la API, incluidos los alcances internos y de consola sensibles, sin requerir autorización explícita, eludiendo los controles de acceso previstos.\n\nLa explotación de esta vulnerabilidad puede conducir a una escalada de privilegios, permitiendo a los clientes sin privilegios realizar acciones administrativas no autorizadas, acceder a datos organizacionales confidenciales y, potencialmente, lograr una toma de control completa de la cuenta en implementaciones donde la configuración “authorize_all_scopes” se desvía de su estado deshabilitado predeterminado."}],"id":"CVE-2025-11229","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:28:59.481681Z","version":"2.0.3"}}]},"published":"2026-11-04T06:16:54.070","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
data/2025/CVE-2025-54507.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54507","lastModified":"2026-11-12T20:18:14.030","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54507","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]}
data/2025/CVE-2025-55002.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1, JupyterLab Desktop para macOS se distribuía con el fusible RunAsNode de Electron habilitado, lo que permitía a ELECTRON_RUN_AS_NODE ejecutar código Node.js arbitrario en el proceso de la aplicación. Un atacante que ya puede ejecutar código como el usuario actual puede, por lo tanto, ejecutar código en el contexto de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluyendo el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere una ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial o remota. Windows y Linux no se ven afectados. Esta vulnerabilidad está corregida en la versión 4.6.2-1."}],"id":"CVE-2025-55002","lastModified":"2026-11-11T05:19:13.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-55002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:29:38.969959Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.390","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1, JupyterLab Desktop para macOS se distribuía con el fusible RunAsNode de Electron habilitado, lo que permitía a ELECTRON_RUN_AS_NODE ejecutar código Node.js arbitrario en el proceso de la aplicación. Un atacante que ya puede ejecutar código como el usuario actual puede, por lo tanto, ejecutar código en el contexto de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluyendo el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere una ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial o remota. Windows y Linux no se ven afectados. Esta vulnerabilidad está corregida en la versión 4.6.2-1."}],"id":"CVE-2025-55002","lastModified":"2026-11-12T22:10:38.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-55002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:29:38.969959Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.390","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2025/CVE-2025-59847.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59847","lastModified":"2026-11-11T08:17:16.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59847","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]}
data/2025/CVE-2025-59848.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59848","lastModified":"2026-11-11T08:17:16.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59848","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]}
data/2025/CVE-2025-71451.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/serverside/serverbackupprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como ClientName, BackupName y grpName que se interpolan sin sanear en llamadas a loadXMLDoc() y se reflejan en solicitudes POST de AbortBackup() a dodeleteclientbackup.sgp. Los atacantes pueden crear enlaces o solicitudes maliciosas para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71451","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71451","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:28:15.713821Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.470","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/serverside/serverbackupprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como ClientName, BackupName y grpName que se interpolan sin sanear en llamadas a loadXMLDoc() y se reflejan en solicitudes POST de AbortBackup() a dodeleteclientbackup.sgp. Los atacantes pueden crear enlaces o solicitudes maliciosas para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71451","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71451","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:28:15.713821Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.470","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71452.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la versión 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/clientside/restoreprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como mn, rnm, isRepliRestore, rusr y rpwd, los cuales se reflejan sin sanitizar en la respuesta HTML. Los atacantes pueden crear enlaces maliciosos para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71452","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:43:28.447757Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.643","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la versión 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/clientside/restoreprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como mn, rnm, isRepliRestore, rusr y rpwd, los cuales se reflejan sin sanitizar en la respuesta HTML. Los atacantes pueden crear enlaces maliciosos para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71452","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:43:28.447757Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.643","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71453.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."},{"lang":"es","value":"vtenext versiones anteriores a la 25.02.2 contiene una vulnerabilidad de Cross-site Scripting (XSS) reflejado en modules/Home/HomeWidgetBlockList.php que devuelve claves ’widgetId’ no saneadas del parámetro JSON ’widgetInfoList’. Los atacantes pueden inducir a un usuario autenticado a enviar una solicitud POST manipulada con HTML en las claves ’widgetId’, ejecutando JavaScript en la sesión de vtenext de la víctima."}],"id":"CVE-2025-71453","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."},{"lang":"es","value":"vtenext versiones anteriores a la 25.02.2 contiene una vulnerabilidad de Cross-site Scripting (XSS) reflejado en modules/Home/HomeWidgetBlockList.php que devuelve claves ’widgetId’ no saneadas del parámetro JSON ’widgetInfoList’. Los atacantes pueden inducir a un usuario autenticado a enviar una solicitud POST manipulada con HTML en las claves ’widgetId’, ejecutando JavaScript en la sesión de vtenext de la víctima."}],"id":"CVE-2025-71453","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71454.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene un bypass de la protección contra falsificación de petición en sitios cruzados (CSRF) porque csrf_check() en include/utils/VteCsrf.php omite la validación del token __csrf_token para peticiones que no son POST. Los atacantes pueden inducir a un usuario autenticado a abrir un enlace manipulado que envía peticiones GET que cambian el estado, las cuales los manejadores leen de $_REQUEST, realizando acciones como ese usuario."}],"id":"CVE-2025-71454","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71454","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:05:52.954478Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.840","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-csrf-protection-bypass-via-http-method-tampering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene un bypass de la protección contra falsificación de petición en sitios cruzados (CSRF) porque csrf_check() en include/utils/VteCsrf.php omite la validación del token __csrf_token para peticiones que no son POST. Los atacantes pueden inducir a un usuario autenticado a abrir un enlace manipulado que envía peticiones GET que cambian el estado, las cuales los manejadores leen de $_REQUEST, realizando acciones como ese usuario."}],"id":"CVE-2025-71454","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71454","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:05:52.954478Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.840","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-csrf-protection-bypass-via-http-method-tampering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71455.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene una vulnerabilidad de divulgación de identificador de sesión que permite a los atacantes leer el valor PHPSESSID devuelto por el endpoint del servicio web Touch. Los atacantes que pueden ejecutar scripts en el origen de vtenext, como a través de Cross-site Scripting (XSS), pueden eludir la bandera HttpOnly y secuestrar sesiones autenticadas."}],"id":"CVE-2025-71455","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:23:26.787003Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.017","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene una vulnerabilidad de divulgación de identificador de sesión que permite a los atacantes leer el valor PHPSESSID devuelto por el endpoint del servicio web Touch. Los atacantes que pueden ejecutar scripts en el origen de vtenext, como a través de Cross-site Scripting (XSS), pueden eludir la bandera HttpOnly y secuestrar sesiones autenticadas."}],"id":"CVE-2025-71455","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:23:26.787003Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.017","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71456.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts."},{"lang":"es","value":"vtenext en versiones anteriores a la 25.02.2 contiene una vulnerabilidad de inyección SQL que permite a usuarios autenticados con bajos privilegios inyectar SQL al proporcionar un parámetro ’fieldname’ manipulado a modules/Fax/EditView.php. Los atacantes pueden leer contenido arbitrario de la base de datos, incluyendo tokens de restablecimiento de contraseña almacenados en vte_userauthtoken, para tomar el control de otras cuentas de usuario."}],"id":"CVE-2025-71456","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71456","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:24:36.654277Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.183","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-sql-injection-via-fieldname-in-fax-editview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts."},{"lang":"es","value":"vtenext en versiones anteriores a la 25.02.2 contiene una vulnerabilidad de inyección SQL que permite a usuarios autenticados con bajos privilegios inyectar SQL al proporcionar un parámetro ’fieldname’ manipulado a modules/Fax/EditView.php. Los atacantes pueden leer contenido arbitrario de la base de datos, incluyendo tokens de restablecimiento de contraseña almacenados en vte_userauthtoken, para tomar el control de otras cuentas de usuario."}],"id":"CVE-2025-71456","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71456","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:24:36.654277Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.183","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-sql-injection-via-fieldname-in-fax-editview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71457.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.1","status":"affected","version":"25.02","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication."},{"lang":"es","value":"vtenext 25.02 anterior a la versión 25.02.1 contiene una vulnerabilidad de omisión de autenticación que permite a atacantes no autenticados cambiar la contraseña de cualquier cuenta a través de hub/rpwd.php sin verificación de token. Los atacantes que conocen un user_name válido pueden enviar action=change_password a RecoverPwd::displayChangePwd() e iniciar sesión como administradores que carecen de autenticación de dos factores."}],"id":"CVE-2025-71457","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71457","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:00.929154Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.340","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.1","status":"affected","version":"25.02","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication."},{"lang":"es","value":"vtenext 25.02 anterior a la versión 25.02.1 contiene una vulnerabilidad de omisión de autenticación que permite a atacantes no autenticados cambiar la contraseña de cualquier cuenta a través de hub/rpwd.php sin verificación de token. Los atacantes que conocen un user_name válido pueden enviar action=change_password a RecoverPwd::displayChangePwd() e iniciar sesión como administradores que carecen de autenticación de dos factores."}],"id":"CVE-2025-71457","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71457","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:00.929154Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.340","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2025/CVE-2025-71458.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"fts-monitoring","repo":"https://github.com/cern-fts/fts-monitoring","vendor":"cern-fts","versions":[{"lessThan":"3.13.3","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.1","status":"affected","version":"3.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets."},{"lang":"es","value":"FTS3 Web Monitoring (fts-monitoring) versiones 3.12.0 hasta la 3.13.2 incluida y 3.14.0 contienen una vulnerabilidad de inyección SQL no autenticada en el endpoint /linkinfo gestionado por get_linkinfo. Atacantes remotos pueden inyectar SQL a través de los parámetros de consulta source_se y dest_se para realizar una inyección a ciegas y leer credenciales de almacenamiento en la nube almacenadas y secretos de cliente del proveedor de tokens."}],"id":"CVE-2025-71458","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:56.290509Z","version":"2.0.3"}}]},"published":"2026-11-06T01:17:47.737","references":[{"source":"disclosure@vulncheck.com","url":"https://advisories.egi.eu/Advisory-EGI-SVG-2025-09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"fts-monitoring","repo":"https://github.com/cern-fts/fts-monitoring","vendor":"cern-fts","versions":[{"lessThan":"3.13.3","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.1","status":"affected","version":"3.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets."},{"lang":"es","value":"FTS3 Web Monitoring (fts-monitoring) versiones 3.12.0 hasta la 3.13.2 incluida y 3.14.0 contienen una vulnerabilidad de inyección SQL no autenticada en el endpoint /linkinfo gestionado por get_linkinfo. Atacantes remotos pueden inyectar SQL a través de los parámetros de consulta source_se y dest_se para realizar una inyección a ciegas y leer credenciales de almacenamiento en la nube almacenadas y secretos de cliente del proveedor de tokens."}],"id":"CVE-2025-71458","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:56.290509Z","version":"2.0.3"}}]},"published":"2026-11-06T01:17:47.737","references":[{"source":"disclosure@vulncheck.com","url":"https://advisories.egi.eu/Advisory-EGI-SVG-2025-09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2026/CVE-2026-0169.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0169","lastModified":"2026-11-10T21:46:32.010","metrics":{},"published":"2026-11-10T20:17:20.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0169","lastModified":"2026-11-12T21:17:17.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:38:03.568064Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-489"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-0455.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Versal™ AI Edge Series Gen 2 Adaptive SoCs","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space."}],"id":"CVE-2026-0455","lastModified":"2026-11-12T20:18:14.237","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.237","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Versal™ AI Edge Series Gen 2 Adaptive SoCs","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space."}],"id":"CVE-2026-0455","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.237","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]}
data/2026/CVE-2026-0460.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Bootgen","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity."}],"id":"CVE-2026-0460","lastModified":"2026-11-12T20:18:14.440","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.440","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Bootgen","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity."}],"id":"CVE-2026-0460","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.440","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]}
data/2026/CVE-2026-100290.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.3","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-100290","lastModified":"2026-11-11T16:17:24.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.667","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=31935"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34991"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.3","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-100290","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.667","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=31935"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34991"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}
data/2026/CVE-2026-100395.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"lxc","vendor":"lxc","versions":[{"status":"affected","version":"<= 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The affected surfaces are lxc-copy and liblxc's public lxc_container::clone() API. The privileged cloning process must run as root. The source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component. The clone operation preserves the symlink before updating the hostname. The vulnerable write truncates and overwrites an existing file outside the destination rootfs. When root clones an untrusted container without LXC_CLONE_KEEPNAME, the copied symlink can resolve outside the destination rootfs and cause the privileged process to overwrite an existing host file with the destination container name. Unprivileged use and managers with independent cloning implementations are not affected. LXC_CLONE_KEEPNAME avoids the hostname update and therefore the affected write."}],"id":"CVE-2026-100395","lastModified":"2026-11-09T18:17:18.243","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:36:00.553409Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:41.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/security/advisories/GHSA-r23j-58gg-pjjc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"lxc","vendor":"lxc","versions":[{"status":"affected","version":"<= 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The affected surfaces are lxc-copy and liblxc's public lxc_container::clone() API. The privileged cloning process must run as root. The source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component. The clone operation preserves the symlink before updating the hostname. The vulnerable write truncates and overwrites an existing file outside the destination rootfs. When root clones an untrusted container without LXC_CLONE_KEEPNAME, the copied symlink can resolve outside the destination rootfs and cause the privileged process to overwrite an existing host file with the destination container name. Unprivileged use and managers with independent cloning implementations are not affected. LXC_CLONE_KEEPNAME avoids the hostname update and therefore the affected write."}],"id":"CVE-2026-100395","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:36:00.553409Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:41.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/security/advisories/GHSA-r23j-58gg-pjjc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102280.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"Sandboxie","vendor":"sandboxie-plus","versions":[{"status":"affected","version":"< 1.18.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6."}],"id":"CVE-2026-102280","lastModified":"2026-11-05T21:18:34.357","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102280","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:49:08.407707Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:42.873","references":[{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/commit/4e121cc4dacdc31973adcb81581b0414d48c26fc"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.6"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"Sandboxie","vendor":"sandboxie-plus","versions":[{"status":"affected","version":"< 1.18.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6."}],"id":"CVE-2026-102280","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102280","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:49:08.407707Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:42.873","references":[{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/commit/4e121cc4dacdc31973adcb81581b0414d48c26fc"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.6"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102289.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."}],"id":"CVE-2026-102289","lastModified":"2026-11-09T22:18:21.590","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.590","references":[{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2213"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2215"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."}],"id":"CVE-2026-102289","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.590","references":[{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2213"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2215"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Primary"}]}
data/2026/CVE-2026-102344.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"lavish-axi","vendor":"kunchenguid","versions":[{"status":"affected","version":"< 0.1.43"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43."}],"id":"CVE-2026-102344","lastModified":"2026-11-09T14:17:05.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102344","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:24:08.716882Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.323","references":[{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"lavish-axi","vendor":"kunchenguid","versions":[{"status":"affected","version":"< 0.1.43"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43."}],"id":"CVE-2026-102344","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102344","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:24:08.716882Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.323","references":[{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102356.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":">= 0.26.0, < 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102356","lastModified":"2026-11-09T23:17:10.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:34:57.248729Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:36.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":">= 0.26.0, < 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102356","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:34:57.248729Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:36.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102359.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":"< 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102359","lastModified":"2026-11-11T05:19:15.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:13:29.742291Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.110","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":"< 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102359","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:13:29.742291Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.110","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102530.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1."}],"id":"CVE-2026-102530","lastModified":"2026-11-09T23:17:10.373","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:10.314722Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1."}],"id":"CVE-2026-102530","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:10.314722Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102610.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"fast-agent","vendor":"evalstate","versions":[{"status":"affected","version":"< 0.7.21"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21."}],"id":"CVE-2026-102610","lastModified":"2026-11-09T23:17:10.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:12.920835Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.677","references":[{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/pull/828"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"fast-agent","vendor":"evalstate","versions":[{"status":"affected","version":"< 0.7.21"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21."}],"id":"CVE-2026-102610","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:12.920835Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.677","references":[{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/pull/828"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102618.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"],"product":"i","vendor":"IBM","versions":[{"status":"affected","version":"7.6"},{"status":"affected","version":"7.5"},{"status":"affected","version":"7.4"},{"status":"affected","version":"7.3"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable."}],"id":"CVE-2026-102618","lastModified":"2026-11-08T16:16:36.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.6,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T16:16:36.283","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295136"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"],"product":"i","vendor":"IBM","versions":[{"status":"affected","version":"7.6"},{"status":"affected","version":"7.5"},{"status":"affected","version":"7.4"},{"status":"affected","version":"7.3"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable."}],"id":"CVE-2026-102618","lastModified":"2026-11-12T21:17:17.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.6,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:10:31.278004Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:36.283","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295136"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-102643.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"asyncssh","vendor":"ronf","versions":[{"status":"affected","version":"< 2.24.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1."}],"id":"CVE-2026-102643","lastModified":"2026-11-09T22:18:21.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-50"}],"source":"security-advisories@github.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"product":"asyncssh","vendor":"ronf","versions":[{"status":"affected","version":"< 2.24.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1."}],"id":"CVE-2026-102643","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-50"}],"source":"security-advisories@github.com","type":"Primary"}]}
data/2026/CVE-2026-102650.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"content","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2."}],"id":"CVE-2026-102650","lastModified":"2026-11-10T20:17:22.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102650","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:00:27.289455Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.333","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/pull/3819"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/releases/tag/v3.15.2"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"content","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2."}],"id":"CVE-2026-102650","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102650","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:00:27.289455Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.333","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/pull/3819"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/releases/tag/v3.15.2"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102803.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Primary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-12T22:17:34.157","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:35:28.982773Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Secondary"}]}
data/2026/CVE-2026-102894.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 0.7.1, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-102894","lastModified":"2026-11-06T12:17:15.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102894","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:42.523586Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5753"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5923"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 0.7.1, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-102894","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102894","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:42.523586Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5753"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5923"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102927.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"hedgedoc","vendor":"hedgedoc","versions":[{"status":"affected","version":"< 1.11.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1."}],"id":"CVE-2026-102927","lastModified":"2026-11-09T18:17:18.387","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:28:34.545953Z","version":"2.0.3"}}]},"published":"2026-11-05T18:16:59.140","references":[{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"hedgedoc","vendor":"hedgedoc","versions":[{"status":"affected","version":"< 1.11.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1."}],"id":"CVE-2026-102927","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:28:34.545953Z","version":"2.0.3"}}]},"published":"2026-11-05T18:16:59.140","references":[{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-102943.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"dagu","vendor":"dagucloud","versions":[{"status":"affected","version":"< 2.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0."}],"id":"CVE-2026-102943","lastModified":"2026-11-06T18:17:37.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102943","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:42:43.623220Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:49.180","references":[{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/commit/c15c5406bb7b9551f94ab276705f9fd1cebbf2d2"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/pull/2424"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/releases/tag/v2.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"dagu","vendor":"dagucloud","versions":[{"status":"affected","version":"< 2.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0."}],"id":"CVE-2026-102943","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102943","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:42:43.623220Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:49.180","references":[{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/commit/c15c5406bb7b9551f94ab276705f9fd1cebbf2d2"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/pull/2424"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/releases/tag/v2.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-103002.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 2.2.0, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-103002","lastModified":"2026-11-06T12:17:15.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:43.686904Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5911"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5936"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 2.2.0, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-103002","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:43.686904Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5911"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5936"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-103022.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"urwid","vendor":"urwid","versions":[{"status":"affected","version":"< 4.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7."}],"id":"CVE-2026-103022","lastModified":"2026-11-11T05:19:15.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:39:06.834605Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:49.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/pull/1201"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/releases/tag/4.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-775"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"urwid","vendor":"urwid","versions":[{"status":"affected","version":"< 4.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7."}],"id":"CVE-2026-103022","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:39:06.834605Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:49.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/pull/1201"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/releases/tag/4.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-775"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-103932.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.5, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-103932","lastModified":"2026-11-09T18:17:18.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103932","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:14:11.605958Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:24.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-253"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.5, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-103932","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103932","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:14:11.605958Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:24.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-253"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-103963.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS)."}],"id":"CVE-2026-103963","lastModified":"2026-11-04T22:17:44.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:03:18.185158Z","version":"2.0.3"}}]},"published":"2026-10-30T05:16:57.237","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465656"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.68.3-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.68.3-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS)."}],"id":"CVE-2026-103963","lastModified":"2026-11-12T22:17:34.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:03:18.185158Z","version":"2.0.3"}}]},"published":"2026-10-30T05:16:57.237","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99695"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465656"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]}
data/2026/CVE-2026-103980.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."}],"id":"CVE-2026-103980","lastModified":"2026-11-11T21:16:42.083","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:42.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."}],"id":"CVE-2026-103980","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:42.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]}
data/2026/CVE-2026-104060.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Worklenz/worklenz","product":"worklenz","repo":"https://github.com/Worklenz/worklenz","vendor":"Worklenz","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes."}],"id":"CVE-2026-104060","lastModified":"2026-11-10T20:17:23.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T20:17:23.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Worklenz/worklenz","product":"worklenz","repo":"https://github.com/Worklenz/worklenz","vendor":"Worklenz","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes."}],"id":"CVE-2026-104060","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T20:17:23.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
data/2026/CVE-2026-104254.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"liboqs","vendor":"open-quantum-safe","versions":[{"status":"affected","version":">= 0.11.0, <= 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0."}],"id":"CVE-2026-104254","lastModified":"2026-11-09T23:17:11.247","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104254","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:48.736338Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.107","references":[{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/commit/df3eb80fe68d2e5db0ecf5d503082cd5699e0859"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/pull/2507"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-wh5q-mpc8-67wf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"liboqs","vendor":"open-quantum-safe","versions":[{"status":"affected","version":">= 0.11.0, <= 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0."}],"id":"CVE-2026-104254","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104254","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:48.736338Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.107","references":[{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/commit/df3eb80fe68d2e5db0ecf5d503082cd5699e0859"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/pull/2507"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-wh5q-mpc8-67wf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-104259.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-104259","lastModified":"2026-11-10T19:17:41.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:32.704323Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:22.160","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/264f348ae1823cb71cead3650b74c165678a1d46"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/49a65f471d3130b91f7fff9bfac9fe8dd9b97c44"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrch-pjfr-9g47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-104259","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:32.704323Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:22.160","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/264f348ae1823cb71cead3650b74c165678a1d46"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/49a65f471d3130b91f7fff9bfac9fe8dd9b97c44"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrch-pjfr-9g47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-104267.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"botan","vendor":"randombit","versions":[{"status":"affected","version":">= 2.7.0, < 3.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0."}],"id":"CVE-2026-104267","lastModified":"2026-11-11T05:19:15.803","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:38:20.231461Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.303","references":[{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/commit/459acdeba242dacc11ad8225e7d3e28203ce4f78"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/pull/5629"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/security/advisories/GHSA-36rp-hhp4-wh83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"botan","vendor":"randombit","versions":[{"status":"affected","version":">= 2.7.0, < 3.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0."}],"id":"CVE-2026-104267","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:38:20.231461Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.303","references":[{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/commit/459acdeba242dacc11ad8225e7d3e28203ce4f78"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/pull/5629"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/security/advisories/GHSA-36rp-hhp4-wh83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-104269.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-104269","lastModified":"2026-11-09T18:17:19.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104269","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:15:25.361996Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:29.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-104269","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104269","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:15:25.361996Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:29.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-104608.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-104608","lastModified":"2026-11-06T19:17:06.287","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:10:23.666531Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:24.420","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-1265"}],"source":"product-cna@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-104608","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:10:23.666531Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:24.420","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-1265"}],"source":"product-cna@github.com","type":"Secondary"}]}
data/2026/CVE-2026-105459.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation."}],"id":"CVE-2026-105459","lastModified":"2026-11-10T17:01:09.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:00.013","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation."}],"id":"CVE-2026-105459","lastModified":"2026-11-12T21:17:17.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:11:04.981852Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:00.013","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-105612.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions"}],"id":"CVE-2026-105612","lastModified":"2026-11-05T17:17:33.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:00:32.266528Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:02.850","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/702"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions"}],"id":"CVE-2026-105612","lastModified":"2026-11-12T21:03:11.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:00:32.266528Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:02.850","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/702"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-105618.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105618","lastModified":"2026-11-05T17:17:34.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:57:09.390532Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.633","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/696"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105618","lastModified":"2026-11-12T21:00:39.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:57:09.390532Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.633","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/696"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-105619.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105619","lastModified":"2026-11-05T17:17:34.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:51.078427Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.780","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/697"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105619","lastModified":"2026-11-12T20:55:18.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:51.078427Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.780","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/697"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-105620.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105620","lastModified":"2026-11-05T17:17:34.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:25.420575Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:04.003","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/698"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105620","lastModified":"2026-11-12T20:54:09.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:25.420575Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:04.003","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/698"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-106018.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EasyIO FW","vendor":"Johnson Controls","versions":[{"lessThanOrEqual":"3.0b25","status":"affected","version":"0","versionType":"custom"}]}],"source":"productsecurity@jci.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.\n\nThis issue affects EasyIO FW: through 3.0b25."}],"id":"CVE-2026-106018","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productsecurity@jci.com","type":"Secondary"}]},"published":"2026-11-12T21:17:17.923","references":[{"source":"productsecurity@jci.com","url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}],"sourceIdentifier":"productsecurity@jci.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"productsecurity@jci.com","type":"Secondary"}]}
data/2026/CVE-2026-106554.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.fasterxml.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"2.18.12","status":"affected","version":"2.15.0","versionType":"maven"},{"status":"unaffected","version":"2.18.12","versionType":"maven"},{"lessThan":"2.21.8","status":"affected","version":"2.19.0","versionType":"maven"},{"status":"unaffected","version":"2.21.8","versionType":"maven"},{"lessThan":"2.22.4","status":"affected","version":"2.22.0","versionType":"maven"},{"status":"unaffected","version":"2.22.4","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"tools.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"3.1.8","status":"affected","version":"3.0.0","versionType":"maven"},{"status":"unaffected","version":"3.1.8","versionType":"maven"},{"lessThan":"3.2.4","status":"affected","version":"3.2.0","versionType":"maven"},{"status":"unaffected","version":"3.2.4","versionType":"maven"}]}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"cveTags":[],"descriptions":[{"lang":"en","value":"One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."}],"id":"CVE-2026-106554","lastModified":"2026-11-10T13:18:19.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106554","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:57:21.443264Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:32.640","references":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"}],"sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.fasterxml.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"2.18.12","status":"affected","version":"2.15.0","versionType":"maven"},{"status":"unaffected","version":"2.18.12","versionType":"maven"},{"lessThan":"2.21.8","status":"affected","version":"2.19.0","versionType":"maven"},{"status":"unaffected","version":"2.21.8","versionType":"maven"},{"lessThan":"2.22.4","status":"affected","version":"2.22.0","versionType":"maven"},{"status":"unaffected","version":"2.22.4","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"tools.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"3.1.8","status":"affected","version":"3.0.0","versionType":"maven"},{"status":"unaffected","version":"3.1.8","versionType":"maven"},{"lessThan":"3.2.4","status":"affected","version":"3.2.0","versionType":"maven"},{"status":"unaffected","version":"3.2.4","versionType":"maven"}]}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"cveTags":[],"descriptions":[{"lang":"en","value":"One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."}],"id":"CVE-2026-106554","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106554","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:57:21.443264Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:32.640","references":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"}],"sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]}
data/2026/CVE-2026-106713.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component"}],"id":"CVE-2026-106713","lastModified":"2026-11-10T14:17:11.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106713","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:15:16.491153Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.613","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/FreeReels_2.3.11"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component"}],"id":"CVE-2026-106713","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106713","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:15:16.491153Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.613","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/FreeReels_2.3.11"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-106714.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link."}],"id":"CVE-2026-106714","lastModified":"2026-11-10T14:17:11.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106714","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:13:51.371117Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.767","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/<number> path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link."}],"id":"CVE-2026-106714","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106714","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:13:51.371117Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.767","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-106715.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link."}],"id":"CVE-2026-106715","lastModified":"2026-11-10T13:18:19.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106715","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:08:24.721739Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.900","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/NewsBreak_26.21.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link."}],"id":"CVE-2026-106715","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106715","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:08:24.721739Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.900","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/NewsBreak_26.21.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-106716.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload."}],"id":"CVE-2026-106716","lastModified":"2026-11-10T13:18:20.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106716","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:02:03.440353Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.033","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/ReelShort_3.8.55"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload."}],"id":"CVE-2026-106716","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106716","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:02:03.440353Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.033","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/ReelShort_3.8.55"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-107245.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"23.1.2","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."}],"id":"CVE-2026-107245","lastModified":"2026-11-12T14:17:22.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107245","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:27:13.231481Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.740","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"support@hackerone.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"23.1.2","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."}],"id":"CVE-2026-107245","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107245","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:27:13.231481Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.740","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"support@hackerone.com","type":"Secondary"}]}
data/2026/CVE-2026-107246.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Plesk extension \"Site Import\"","vendor":"WebPros","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root."}],"id":"CVE-2026-107246","lastModified":"2026-11-12T14:17:22.757","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:25:49.064016Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.880","references":[{"source":"support@hackerone.com","url":"https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"support@hackerone.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Plesk extension \"Site Import\"","vendor":"WebPros","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root."}],"id":"CVE-2026-107246","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:25:49.064016Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.880","references":[{"source":"support@hackerone.com","url":"https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"support@hackerone.com","type":"Secondary"}]}
data/2026/CVE-2026-107331.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"product":"DataStage on Cloud Pak for Data","vendor":"IBM","versions":[{"status":"affected","version":"5.4.0.0"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability."}],"id":"CVE-2026-107331","lastModified":"2026-11-08T17:16:35.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T17:16:35.550","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294270"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"product":"DataStage on Cloud Pak for Data","vendor":"IBM","versions":[{"status":"affected","version":"5.4.0.0"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability."}],"id":"CVE-2026-107331","lastModified":"2026-11-12T21:17:19.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107331","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:06:01.953926Z","version":"2.0.3"}}]},"published":"2026-11-08T17:16:35.550","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294270"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-107359.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WF200 FW","repo":"https://github.com/SiliconLabs/wfx-firmware/","vendor":"Silicon Labs","versions":[{"lessThanOrEqual":"3.17.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@silabs.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault."}],"id":"CVE-2026-107359","lastModified":"2026-11-05T20:17:40.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-security@silabs.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107359","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:42.303262Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:00.370","references":[{"source":"product-security@silabs.com","url":"https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md"}],"sourceIdentifier":"product-security@silabs.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"product-security@silabs.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WF200 FW","repo":"https://github.com/SiliconLabs/wfx-firmware/","vendor":"Silicon Labs","versions":[{"lessThanOrEqual":"3.17.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@silabs.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault."}],"id":"CVE-2026-107359","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-security@silabs.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107359","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:42.303262Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:00.370","references":[{"source":"product-security@silabs.com","url":"https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md"}],"sourceIdentifier":"product-security@silabs.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"product-security@silabs.com","type":"Secondary"}]}
data/2026/CVE-2026-107891.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"musl","vendor":"musl -libc","versions":[{"lessThan":"1.2.7","status":"affected","version":"0.5.0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}],"id":"CVE-2026-107891","lastModified":"2026-11-09T22:18:22.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:09:44.546721Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:32.150","references":[{"source":"cve@mitre.org","url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"},{"source":"cve@mitre.org","url":"https://musl.libc.org"},{"source":"cve@mitre.org","url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/21/18"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cve@mitre.org","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"musl","vendor":"musl -libc","versions":[{"lessThan":"1.2.7","status":"affected","version":"0.5.0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}],"id":"CVE-2026-107891","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:09:44.546721Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:32.150","references":[{"source":"cve@mitre.org","url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"},{"source":"cve@mitre.org","url":"https://musl.libc.org"},{"source":"cve@mitre.org","url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/21/18"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cve@mitre.org","type":"Secondary"}]}
data/2026/CVE-2026-108018.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigFix MCM & Mobile","vendor":"HCLSoftware","versions":[{"status":"affected","version":"<= 3.7"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts."}],"id":"CVE-2026-108018","lastModified":"2026-11-10T18:17:18.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"psirt@hcl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:33:57.046825Z","version":"2.0.3"}}]},"published":"2026-11-06T09:16:59.527","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@hcl.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigFix MCM & Mobile","vendor":"HCLSoftware","versions":[{"status":"affected","version":"<= 3.7"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts."}],"id":"CVE-2026-108018","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"psirt@hcl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:33:57.046825Z","version":"2.0.3"}}]},"published":"2026-11-06T09:16:59.527","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@hcl.com","type":"Secondary"}]}
data/2026/CVE-2026-108262.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":">= 1.25.2, < 1.25.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4."}],"id":"CVE-2026-108262","lastModified":"2026-11-11T05:19:17.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:16:29.590639Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:06.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":">= 1.25.2, < 1.25.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4."}],"id":"CVE-2026-108262","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:16:29.590639Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:06.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-108387.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"radare2","vendor":"radareorg","versions":[{"status":"affected","version":"< 6.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2."}],"id":"CVE-2026-108387","lastModified":"2026-11-09T22:18:22.767","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:54:41.534947Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/issues/26600"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/releases/tag/6.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"radare2","vendor":"radareorg","versions":[{"status":"affected","version":"< 6.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2."}],"id":"CVE-2026-108387","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:54:41.534947Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/issues/26600"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/releases/tag/6.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-10859.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads."}],"id":"CVE-2026-10859","lastModified":"2026-11-09T17:17:08.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:26.094303Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.103","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294664"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"44950C6B-710F-4B6B-BFAE-73E4407F51B9","versionEndExcluding":"9.2.0.46","versionStartIncluding":"9.2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"C068FAC7-7DCA-4E46-9B3F-06F513967C6A","versionEndExcluding":"9.3.0.43","versionStartIncluding":"9.3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"9E0A65D6-9040-41E2-8B5F-3264D565E761","versionEndExcluding":"9.4.0.30","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"53BCC172-C8CC-4B55-A7C5-F262E5CC7274","versionEndIncluding":"9.4.5.1","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"391B1041-23BF-4298-B1D3-4434C2B923CE","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"88A41538-EECC-4308-B3D8-F9742A3C2A05","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads."}],"id":"CVE-2026-10859","lastModified":"2026-11-12T21:31:32.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:26.094303Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.103","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7294664"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
data/2026/CVE-2026-109097.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-10T12:17:16.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Primary"}]}
data/2026/CVE-2026-109797.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP/astonish","vendor":"SAP_SE","versions":[{"status":"affected","version":"<v3.6.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there."}],"id":"CVE-2026-109797","lastModified":"2026-11-10T20:17:37.727","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:39:33.380779Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.603","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"cna@sap.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP/astonish","vendor":"SAP_SE","versions":[{"status":"affected","version":"<v3.6.0"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there."}],"id":"CVE-2026-109797","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:39:33.380779Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.603","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/astonish/security/advisories/GHSA-93c9-96j8-4vg9"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"cna@sap.com","type":"Secondary"}]}
data/2026/CVE-2026-109798.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence)","vendor":"SAP_SE","versions":[{"status":"affected","version":"ENTERPRISE 430"},{"status":"affected","version":"2025"},{"status":"affected","version":"2027"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability."}],"id":"CVE-2026-109798","lastModified":"2026-11-10T20:17:37.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.3,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:54:58.048354Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.747","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3799117"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"cna@sap.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence)","vendor":"SAP_SE","versions":[{"status":"affected","version":"ENTERPRISE 430"},{"status":"affected","version":"2025"},{"status":"affected","version":"2027"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability."}],"id":"CVE-2026-109798","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.3,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:54:58.048354Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.747","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3799117"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"cna@sap.com","type":"Secondary"}]}
data/2026/CVE-2026-109799.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for Python","vendor":"SAP_SE","versions":[{"status":"affected","version":"< 0.63.1"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider."}],"id":"CVE-2026-109799","lastModified":"2026-11-10T20:17:38.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109799","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:40.745448Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.887","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"cna@sap.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP Cloud SDK for Python","vendor":"SAP_SE","versions":[{"status":"affected","version":"< 0.63.1"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider."}],"id":"CVE-2026-109799","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109799","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:38:40.745448Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:13.887","references":[{"source":"cna@sap.com","url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"cna@sap.com","type":"Secondary"}]}
data/2026/CVE-2026-109804.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver (SAP Message Server)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64UC 7.53"},{"status":"affected","version":"KERNEL 7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability."}],"id":"CVE-2026-109804","lastModified":"2026-11-10T21:18:15.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109804","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:27:47.394974Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:14.610","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3808552"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"cna@sap.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver (SAP Message Server)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64UC 7.53"},{"status":"affected","version":"KERNEL 7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a high impact on confidentiality. There is no impact on integrity and availability."}],"id":"CVE-2026-109804","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109804","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:27:47.394974Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:14.610","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3808552"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"cna@sap.com","type":"Secondary"}]}
data/2026/CVE-2026-109805.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform (Application Server ABAP)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application."}],"id":"CVE-2026-109805","lastModified":"2026-11-11T05:19:18.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T01:17:14.777","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3786876"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-328"}],"source":"cna@sap.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP NetWeaver and ABAP Platform (Application Server ABAP)","vendor":"SAP_SE","versions":[{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.54"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"source":"cna@sap.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application."}],"id":"CVE-2026-109805","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"cna@sap.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-10T01:17:14.777","references":[{"source":"cna@sap.com","url":"https://me.sap.com/notes/3786876"},{"source":"cna@sap.com","url":"https://url.sap/sapsecuritypatchday"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-328"}],"source":"cna@sap.com","type":"Secondary"}]}
data/2026/CVE-2026-109830.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"meta-iot2050","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V01.03.01","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device."}],"id":"CVE-2026-109830","lastModified":"2026-11-10T16:17:14.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:55.344184Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.387","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-724261.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"productcert@siemens.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"meta-iot2050","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V01.03.01","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device."}],"id":"CVE-2026-109830","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:55.344184Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.387","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-724261.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"productcert@siemens.com","type":"Secondary"}]}
data/2026/CVE-2026-110003.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payara Server","vendor":"Azul Payara","versions":[{"lessThan":"7.6.0","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.2026.11","status":"affected","version":"7.2024.1.Alpha1","versionType":"custom"},{"lessThan":"6.44.0","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2025.11","status":"affected","version":"6.2022.1","versionType":"custom"},{"lessThan":"5.93.0","status":"affected","version":"5.20.0","versionType":"semver"},{"lessThanOrEqual":"5.201.2","status":"affected","version":"5.181","versionType":"custom"},{"lessThanOrEqual":"5.2022.5","status":"affected","version":"5.2020.2","versionType":"custom"},{"lessThan":"4.1.2.191.61","status":"affected","version":"4.1.2.191","versionType":"custom"}]}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server."}],"id":"CVE-2026-110003","lastModified":"2026-11-12T09:16:39.813","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]},"published":"2026-11-12T09:16:39.813","references":[{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html"}],"sourceIdentifier":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payara Server","vendor":"Azul Payara","versions":[{"lessThan":"7.6.0","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.2026.11","status":"affected","version":"7.2024.1.Alpha1","versionType":"custom"},{"lessThan":"6.44.0","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2025.11","status":"affected","version":"6.2022.1","versionType":"custom"},{"lessThan":"5.93.0","status":"affected","version":"5.20.0","versionType":"semver"},{"lessThanOrEqual":"5.201.2","status":"affected","version":"5.181","versionType":"custom"},{"lessThanOrEqual":"5.2022.5","status":"affected","version":"5.2020.2","versionType":"custom"},{"lessThan":"4.1.2.191.61","status":"affected","version":"4.1.2.191","versionType":"custom"}]}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server."}],"id":"CVE-2026-110003","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]},"published":"2026-11-12T09:16:39.813","references":[{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html"}],"sourceIdentifier":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]}
data/2026/CVE-2026-110181.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110181","lastModified":"2026-11-05T17:17:36.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:52.438624Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.473","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110181","lastModified":"2026-11-12T20:53:13.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:52.438624Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.473","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-110182.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110182","lastModified":"2026-11-05T17:17:36.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:26.963712Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.590","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110182","lastModified":"2026-11-12T20:52:10.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:26.963712Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.590","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-110183.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110183","lastModified":"2026-11-05T17:17:36.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:50:57.542566Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.710","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-202"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110183","lastModified":"2026-11-12T20:51:40.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:50:57.542566Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.710","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-202"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]}
data/2026/CVE-2026-110281.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique."}],"id":"CVE-2026-110281","lastModified":"2026-11-08T02:16:35.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:34:43.402907Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.253","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique."}],"id":"CVE-2026-110281","lastModified":"2026-11-12T21:34:07.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:34:43.402907Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.253","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-110282.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control."}],"id":"CVE-2026-110282","lastModified":"2026-11-09T22:18:23.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:53:16.124713Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.410","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control."}],"id":"CVE-2026-110282","lastModified":"2026-11-12T21:34:49.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:53:16.124713Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.410","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-110283.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers."}],"id":"CVE-2026-110283","lastModified":"2026-11-08T02:16:35.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:44:06.490428Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.560","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-99"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers."}],"id":"CVE-2026-110283","lastModified":"2026-11-12T21:37:33.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:44:06.490428Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.560","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-99"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
data/2026/CVE-2026-110288.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-110288","lastModified":"2026-11-06T19:17:07.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:48.946512Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:25.910","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"product-cna@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-110288","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:48.946512Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:25.910","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"product-cna@github.com","type":"Secondary"}]}
data/2026/CVE-2026-110802.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"altair","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-express-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-fastify-plugin","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-koa-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-static","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}],"id":"CVE-2026-110802","lastModified":"2026-11-10T05:17:41.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110802","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:16:25.942801Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/releases/tag/v8.5.8"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"altair","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-express-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-fastify-plugin","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-koa-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-static","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}],"id":"CVE-2026-110802","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110802","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:16:25.942801Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/releases/tag/v8.5.8"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-110930.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"Codex Desktop for Windows","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.52244","status":"affected","version":"26.820.60940","versionType":"custom"},{"status":"unaffected","version":"26.1007.21434"}]},{"product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.7124.0","status":"affected","version":"26.820.7780.0","versionType":"custom"},{"status":"unaffected","version":"26.1007.2314.0"}]}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval."}],"id":"CVE-2026-110930","lastModified":"2026-11-05T21:18:35.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:28:12.900578Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:40.827","references":[{"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","url":"https://openai.com/security/advisories/cve-2026-110930/"}],"sourceIdentifier":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"Codex Desktop for Windows","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.52244","status":"affected","version":"26.820.60940","versionType":"custom"},{"status":"unaffected","version":"26.1007.21434"}]},{"product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.7124.0","status":"affected","version":"26.820.7780.0","versionType":"custom"},{"status":"unaffected","version":"26.1007.2314.0"}]}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval."}],"id":"CVE-2026-110930","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:28:12.900578Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:40.827","references":[{"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","url":"https://openai.com/security/advisories/cve-2026-110930/"}],"sourceIdentifier":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","type":"Secondary"}]}
data/2026/CVE-2026-111433.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read."}],"id":"CVE-2026-111433","lastModified":"2026-11-12T10:17:27.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.160","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"securities@openeuler.org","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read."}],"id":"CVE-2026-111433","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.160","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"securities@openeuler.org","type":"Secondary"}]}
data/2026/CVE-2026-111434.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes."}],"id":"CVE-2026-111434","lastModified":"2026-11-12T10:17:27.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":4.7,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.327","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"securities@openeuler.org","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes."}],"id":"CVE-2026-111434","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":4.7,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.327","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"securities@openeuler.org","type":"Secondary"}]}
data/2026/CVE-2026-111435.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host."}],"id":"CVE-2026-111435","lastModified":"2026-11-12T10:17:27.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.483","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"securities@openeuler.org","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host."}],"id":"CVE-2026-111435","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.483","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"securities@openeuler.org","type":"Secondary"}]}
data/2026/CVE-2026-111436.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"unaffected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nThe memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS)."}],"id":"CVE-2026-111436","lastModified":"2026-11-12T10:17:27.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.630","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/d48130e6d16d603a9c12333b03bd74d63891ab87?ref=master&prId=2651"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"securities@openeuler.org","type":"Secondary"}]}
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"unaffected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nThe memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS)."}],"id":"CVE-2026-111436","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.630","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/d48130e6d16d603a9c12333b03bd74d63891ab87?ref=master&prId=2651"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"securities@openeuler.org","type":"Secondary"}]}
data/2026/CVE-2026-111753.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.34"},{"status":"affected","version":">= 21.0.0, < 21.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3."}],"id":"CVE-2026-111753","lastModified":"2026-11-09T23:17:11.570","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:52:28.681840Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71294"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/65683"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71295"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-359"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.34"},{"status":"affected","version":">= 21.0.0, < 21.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3."}],"id":"CVE-2026-111753","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:52:28.681840Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71294"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/65683"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71295"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-359"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-111768.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111768","lastModified":"2026-11-09T18:17:19.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111768","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:49.133793Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.457","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2926"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2927"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111768","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111768","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:49.133793Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.457","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2926"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2927"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-111769.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"client","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0."}],"id":"CVE-2026-111769","lastModified":"2026-11-09T19:16:39.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T18:39:42.557072Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.637","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2902"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"client","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0."}],"id":"CVE-2026-111769","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T18:39:42.557072Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.637","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2902"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-111771.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"express","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.0.2"}]},{"product":"server-legacy","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}],"id":"CVE-2026-111771","lastModified":"2026-11-10T05:17:42.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:21:00.140745Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.973","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"express","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.0.2"}]},{"product":"server-legacy","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}],"id":"CVE-2026-111771","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:21:00.140745Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.973","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]}
data/2026/CVE-2026-112136.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely."}],"id":"CVE-2026-112136","lastModified":"2026-11-10T17:17:20.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:34:00.788095Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.540","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"productcert@siemens.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely."}],"id":"CVE-2026-112136","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:34:00.788095Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.540","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"productcert@siemens.com","type":"Secondary"}]}
data/2026/CVE-2026-112137.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server."}],"id":"CVE-2026-112137","lastModified":"2026-11-10T12:17:16.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.697","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"productcert@siemens.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server."}],"id":"CVE-2026-112137","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.697","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"productcert@siemens.com","type":"Primary"}]}
data/2026/CVE-2026-112354.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Etrel INCH","vendor":"Etrel d.o.o.","versions":[{"lessThan":"7.1.2","status":"affected","version":"0","versionType":"semver"},{"lessThan":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station."}],"id":"CVE-2026-112354","lastModified":"2026-11-07T04:17:12.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:35:46.880664Z","version":"2.0.3"}}]},"published":"2026-11-03T22:17:44.660","references":[{"source":"disclosure@vulncheck.com","url":"https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware"},{"source":"disclosure@vulncheck.com","url":"https://etrel.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Etrel INCH","vendor":"Etrel d.o.o.","versions":[{"lessThan":"7.1.2","status":"affected","version":"0","versionType":"semver"},{"lessThan":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station."}],"id":"CVE-2026-112354","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:35:46.880664Z","version":"2.0.3"}}]},"published":"2026-11-03T22:17:44.660","references":[{"source":"disclosure@vulncheck.com","url":"https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware"},{"source":"disclosure@vulncheck.com","url":"https://etrel.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]}
data/2026/CVE-2026-112369.json
+1 -1
View File
@@ -1 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms."}],"id":"CVE-2026-112369","lastModified":"2026-11-08T17:16:36.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T17:16:36.277","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"psirt@us.ibm.com","type":"Primary"}]}
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms."}],"id":"CVE-2026-112369","lastModified":"2026-11-12T21:17:19.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:09:04.898403Z","version":"2.0.3"}}]},"published":"2026-11-08T17:16:36.277","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"psirt@us.ibm.com","type":"Secondary"}]}
Loaded 100 of 889 files, more files were not shown because too many files have changed in this diff. Show more