From e05d4ab377e0cf2d7354ede4812a073339a49645 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Thu, 12 Nov 2026 23:47:52 +0100 Subject: [PATCH] NVD update 2026-11-12T22:47:46Z --- data/2017/CVE-2017-20251.json | 2 +- data/2022/CVE-2022-29966.json | 2 +- data/2022/CVE-2022-30267.json | 2 +- data/2024/CVE-2024-21963.json | 2 +- data/2024/CVE-2024-36344.json | 2 +- data/2024/CVE-2024-41786.json | 2 +- data/2025/CVE-2025-0043.json | 2 +- data/2025/CVE-2025-10935.json | 2 +- data/2025/CVE-2025-11229.json | 2 +- data/2025/CVE-2025-54507.json | 2 +- data/2025/CVE-2025-55002.json | 2 +- data/2025/CVE-2025-59847.json | 2 +- data/2025/CVE-2025-59848.json | 2 +- data/2025/CVE-2025-71451.json | 2 +- data/2025/CVE-2025-71452.json | 2 +- data/2025/CVE-2025-71453.json | 2 +- data/2025/CVE-2025-71454.json | 2 +- data/2025/CVE-2025-71455.json | 2 +- data/2025/CVE-2025-71456.json | 2 +- data/2025/CVE-2025-71457.json | 2 +- data/2025/CVE-2025-71458.json | 2 +- data/2026/CVE-2026-0169.json | 2 +- data/2026/CVE-2026-0455.json | 2 +- data/2026/CVE-2026-0460.json | 2 +- data/2026/CVE-2026-100290.json | 2 +- data/2026/CVE-2026-100395.json | 2 +- data/2026/CVE-2026-102280.json | 2 +- data/2026/CVE-2026-102289.json | 2 +- data/2026/CVE-2026-102344.json | 2 +- data/2026/CVE-2026-102356.json | 2 +- data/2026/CVE-2026-102359.json | 2 +- data/2026/CVE-2026-102530.json | 2 +- data/2026/CVE-2026-102610.json | 2 +- data/2026/CVE-2026-102618.json | 2 +- data/2026/CVE-2026-102643.json | 2 +- data/2026/CVE-2026-102650.json | 2 +- data/2026/CVE-2026-102803.json | 2 +- data/2026/CVE-2026-102894.json | 2 +- data/2026/CVE-2026-102927.json | 2 +- data/2026/CVE-2026-102943.json | 2 +- data/2026/CVE-2026-103002.json | 2 +- data/2026/CVE-2026-103022.json | 2 +- data/2026/CVE-2026-103932.json | 2 +- data/2026/CVE-2026-103963.json | 2 +- data/2026/CVE-2026-103980.json | 2 +- data/2026/CVE-2026-104060.json | 2 +- data/2026/CVE-2026-104254.json | 2 +- data/2026/CVE-2026-104259.json | 2 +- data/2026/CVE-2026-104267.json | 2 +- data/2026/CVE-2026-104269.json | 2 +- data/2026/CVE-2026-104608.json | 2 +- data/2026/CVE-2026-105459.json | 2 +- data/2026/CVE-2026-105612.json | 2 +- data/2026/CVE-2026-105618.json | 2 +- data/2026/CVE-2026-105619.json | 2 +- data/2026/CVE-2026-105620.json | 2 +- data/2026/CVE-2026-106018.json | 1 + data/2026/CVE-2026-106554.json | 2 +- data/2026/CVE-2026-106713.json | 2 +- data/2026/CVE-2026-106714.json | 2 +- data/2026/CVE-2026-106715.json | 2 +- data/2026/CVE-2026-106716.json | 2 +- data/2026/CVE-2026-107245.json | 2 +- data/2026/CVE-2026-107246.json | 2 +- data/2026/CVE-2026-107331.json | 2 +- data/2026/CVE-2026-107359.json | 2 +- data/2026/CVE-2026-107891.json | 2 +- data/2026/CVE-2026-108018.json | 2 +- data/2026/CVE-2026-108262.json | 2 +- data/2026/CVE-2026-108387.json | 2 +- data/2026/CVE-2026-10859.json | 2 +- data/2026/CVE-2026-109097.json | 2 +- data/2026/CVE-2026-109797.json | 2 +- data/2026/CVE-2026-109798.json | 2 +- data/2026/CVE-2026-109799.json | 2 +- data/2026/CVE-2026-109804.json | 2 +- data/2026/CVE-2026-109805.json | 2 +- data/2026/CVE-2026-109830.json | 2 +- data/2026/CVE-2026-110003.json | 2 +- data/2026/CVE-2026-110181.json | 2 +- data/2026/CVE-2026-110182.json | 2 +- data/2026/CVE-2026-110183.json | 2 +- data/2026/CVE-2026-110281.json | 2 +- data/2026/CVE-2026-110282.json | 2 +- data/2026/CVE-2026-110283.json | 2 +- data/2026/CVE-2026-110288.json | 2 +- data/2026/CVE-2026-110802.json | 2 +- data/2026/CVE-2026-110930.json | 2 +- data/2026/CVE-2026-111433.json | 2 +- data/2026/CVE-2026-111434.json | 2 +- data/2026/CVE-2026-111435.json | 2 +- data/2026/CVE-2026-111436.json | 2 +- data/2026/CVE-2026-111753.json | 2 +- data/2026/CVE-2026-111768.json | 2 +- data/2026/CVE-2026-111769.json | 2 +- data/2026/CVE-2026-111771.json | 2 +- data/2026/CVE-2026-112136.json | 2 +- data/2026/CVE-2026-112137.json | 2 +- data/2026/CVE-2026-112354.json | 2 +- data/2026/CVE-2026-112369.json | 2 +- data/2026/CVE-2026-112803.json | 2 +- data/2026/CVE-2026-112809.json | 2 +- data/2026/CVE-2026-11315.json | 2 +- data/2026/CVE-2026-11316.json | 2 +- data/2026/CVE-2026-113362.json | 2 +- data/2026/CVE-2026-113363.json | 2 +- data/2026/CVE-2026-113364.json | 2 +- data/2026/CVE-2026-113663.json | 2 +- data/2026/CVE-2026-113780.json | 2 +- data/2026/CVE-2026-113843.json | 2 +- data/2026/CVE-2026-113960.json | 2 +- data/2026/CVE-2026-113961.json | 2 +- data/2026/CVE-2026-113963.json | 2 +- data/2026/CVE-2026-113964.json | 2 +- data/2026/CVE-2026-113965.json | 2 +- data/2026/CVE-2026-113968.json | 2 +- data/2026/CVE-2026-113969.json | 2 +- data/2026/CVE-2026-113970.json | 2 +- data/2026/CVE-2026-114031.json | 2 +- data/2026/CVE-2026-114032.json | 2 +- data/2026/CVE-2026-114134.json | 2 +- data/2026/CVE-2026-114369.json | 2 +- data/2026/CVE-2026-114594.json | 2 +- data/2026/CVE-2026-115738.json | 2 +- data/2026/CVE-2026-115739.json | 2 +- data/2026/CVE-2026-115740.json | 2 +- data/2026/CVE-2026-115770.json | 2 +- data/2026/CVE-2026-115819.json | 2 +- data/2026/CVE-2026-116303.json | 2 +- data/2026/CVE-2026-116304.json | 2 +- data/2026/CVE-2026-116306.json | 2 +- data/2026/CVE-2026-116307.json | 2 +- data/2026/CVE-2026-116308.json | 2 +- data/2026/CVE-2026-116309.json | 2 +- data/2026/CVE-2026-116313.json | 2 +- data/2026/CVE-2026-116314.json | 2 +- data/2026/CVE-2026-116315.json | 2 +- data/2026/CVE-2026-116316.json | 2 +- data/2026/CVE-2026-116317.json | 2 +- data/2026/CVE-2026-116318.json | 2 +- data/2026/CVE-2026-116319.json | 2 +- data/2026/CVE-2026-116320.json | 2 +- data/2026/CVE-2026-116321.json | 2 +- data/2026/CVE-2026-116322.json | 2 +- data/2026/CVE-2026-116331.json | 2 +- data/2026/CVE-2026-116332.json | 2 +- data/2026/CVE-2026-116333.json | 2 +- data/2026/CVE-2026-116335.json | 2 +- data/2026/CVE-2026-116336.json | 2 +- data/2026/CVE-2026-116337.json | 2 +- data/2026/CVE-2026-116376.json | 2 +- data/2026/CVE-2026-116633.json | 2 +- data/2026/CVE-2026-116650.json | 2 +- data/2026/CVE-2026-116651.json | 2 +- data/2026/CVE-2026-116652.json | 2 +- data/2026/CVE-2026-116653.json | 2 +- data/2026/CVE-2026-116654.json | 2 +- data/2026/CVE-2026-116663.json | 2 +- data/2026/CVE-2026-116845.json | 2 +- data/2026/CVE-2026-117373.json | 2 +- data/2026/CVE-2026-117542.json | 2 +- data/2026/CVE-2026-117543.json | 2 +- data/2026/CVE-2026-117544.json | 2 +- data/2026/CVE-2026-117550.json | 2 +- data/2026/CVE-2026-117551.json | 2 +- data/2026/CVE-2026-118208.json | 2 +- data/2026/CVE-2026-118237.json | 2 +- data/2026/CVE-2026-118904.json | 2 +- data/2026/CVE-2026-119055.json | 2 +- data/2026/CVE-2026-119238.json | 2 +- data/2026/CVE-2026-119274.json | 2 +- data/2026/CVE-2026-119344.json | 2 +- data/2026/CVE-2026-119345.json | 2 +- data/2026/CVE-2026-119618.json | 2 +- data/2026/CVE-2026-119743.json | 2 +- data/2026/CVE-2026-119744.json | 2 +- data/2026/CVE-2026-119746.json | 2 +- data/2026/CVE-2026-119747.json | 2 +- data/2026/CVE-2026-119748.json | 2 +- data/2026/CVE-2026-119749.json | 2 +- data/2026/CVE-2026-119751.json | 2 +- data/2026/CVE-2026-119755.json | 2 +- data/2026/CVE-2026-119756.json | 2 +- data/2026/CVE-2026-119757.json | 2 +- data/2026/CVE-2026-119758.json | 2 +- data/2026/CVE-2026-119759.json | 2 +- data/2026/CVE-2026-119776.json | 2 +- data/2026/CVE-2026-119800.json | 2 +- data/2026/CVE-2026-119832.json | 2 +- data/2026/CVE-2026-120033.json | 2 +- data/2026/CVE-2026-120113.json | 2 +- data/2026/CVE-2026-120139.json | 2 +- data/2026/CVE-2026-120141.json | 2 +- data/2026/CVE-2026-120142.json | 2 +- data/2026/CVE-2026-120143.json | 2 +- data/2026/CVE-2026-120144.json | 2 +- data/2026/CVE-2026-120151.json | 2 +- data/2026/CVE-2026-120152.json | 2 +- data/2026/CVE-2026-120153.json | 2 +- data/2026/CVE-2026-120154.json | 2 +- data/2026/CVE-2026-120466.json | 2 +- data/2026/CVE-2026-120467.json | 2 +- data/2026/CVE-2026-120468.json | 2 +- data/2026/CVE-2026-120469.json | 2 +- data/2026/CVE-2026-120470.json | 2 +- data/2026/CVE-2026-120471.json | 2 +- data/2026/CVE-2026-120499.json | 2 +- data/2026/CVE-2026-12067.json | 2 +- data/2026/CVE-2026-120859.json | 2 +- data/2026/CVE-2026-120869.json | 2 +- data/2026/CVE-2026-121577.json | 2 +- data/2026/CVE-2026-121587.json | 2 +- data/2026/CVE-2026-121588.json | 2 +- data/2026/CVE-2026-121602.json | 2 +- data/2026/CVE-2026-121603.json | 2 +- data/2026/CVE-2026-121604.json | 2 +- data/2026/CVE-2026-121620.json | 2 +- data/2026/CVE-2026-121624.json | 2 +- data/2026/CVE-2026-121625.json | 2 +- data/2026/CVE-2026-121626.json | 2 +- data/2026/CVE-2026-121627.json | 2 +- data/2026/CVE-2026-121628.json | 2 +- data/2026/CVE-2026-121691.json | 2 +- data/2026/CVE-2026-121727.json | 2 +- data/2026/CVE-2026-121728.json | 2 +- data/2026/CVE-2026-121729.json | 2 +- data/2026/CVE-2026-121730.json | 2 +- data/2026/CVE-2026-121733.json | 2 +- data/2026/CVE-2026-121734.json | 2 +- data/2026/CVE-2026-121735.json | 2 +- data/2026/CVE-2026-121736.json | 2 +- data/2026/CVE-2026-121825.json | 2 +- data/2026/CVE-2026-121936.json | 2 +- data/2026/CVE-2026-121937.json | 2 +- data/2026/CVE-2026-121938.json | 2 +- data/2026/CVE-2026-121940.json | 2 +- data/2026/CVE-2026-121941.json | 2 +- data/2026/CVE-2026-121945.json | 2 +- data/2026/CVE-2026-121946.json | 2 +- data/2026/CVE-2026-121967.json | 2 +- data/2026/CVE-2026-121968.json | 2 +- data/2026/CVE-2026-121969.json | 2 +- data/2026/CVE-2026-121970.json | 2 +- data/2026/CVE-2026-121993.json | 2 +- data/2026/CVE-2026-122006.json | 2 +- data/2026/CVE-2026-122007.json | 2 +- data/2026/CVE-2026-122008.json | 2 +- data/2026/CVE-2026-122054.json | 2 +- data/2026/CVE-2026-122095.json | 2 +- data/2026/CVE-2026-122126.json | 2 +- data/2026/CVE-2026-122127.json | 2 +- data/2026/CVE-2026-122129.json | 2 +- data/2026/CVE-2026-122130.json | 2 +- data/2026/CVE-2026-122131.json | 2 +- data/2026/CVE-2026-122133.json | 2 +- data/2026/CVE-2026-122134.json | 2 +- data/2026/CVE-2026-122135.json | 2 +- data/2026/CVE-2026-122137.json | 2 +- data/2026/CVE-2026-122138.json | 2 +- data/2026/CVE-2026-122139.json | 2 +- data/2026/CVE-2026-122140.json | 2 +- data/2026/CVE-2026-122220.json | 2 +- data/2026/CVE-2026-122234.json | 2 +- data/2026/CVE-2026-122235.json | 2 +- data/2026/CVE-2026-122317.json | 2 +- data/2026/CVE-2026-122324.json | 2 +- data/2026/CVE-2026-122325.json | 2 +- data/2026/CVE-2026-122326.json | 2 +- data/2026/CVE-2026-122327.json | 2 +- data/2026/CVE-2026-122328.json | 2 +- data/2026/CVE-2026-122329.json | 2 +- data/2026/CVE-2026-122330.json | 2 +- data/2026/CVE-2026-122992.json | 2 +- data/2026/CVE-2026-123010.json | 2 +- data/2026/CVE-2026-123011.json | 2 +- data/2026/CVE-2026-123012.json | 2 +- data/2026/CVE-2026-123014.json | 2 +- data/2026/CVE-2026-123017.json | 2 +- data/2026/CVE-2026-123025.json | 2 +- data/2026/CVE-2026-123029.json | 2 +- data/2026/CVE-2026-123033.json | 2 +- data/2026/CVE-2026-123094.json | 2 +- data/2026/CVE-2026-123095.json | 2 +- data/2026/CVE-2026-123096.json | 2 +- data/2026/CVE-2026-123139.json | 2 +- data/2026/CVE-2026-123178.json | 2 +- data/2026/CVE-2026-123180.json | 2 +- data/2026/CVE-2026-123197.json | 2 +- data/2026/CVE-2026-123198.json | 2 +- data/2026/CVE-2026-123199.json | 2 +- data/2026/CVE-2026-123200.json | 2 +- data/2026/CVE-2026-123201.json | 2 +- data/2026/CVE-2026-123202.json | 2 +- data/2026/CVE-2026-123203.json | 2 +- data/2026/CVE-2026-123204.json | 2 +- data/2026/CVE-2026-123205.json | 2 +- data/2026/CVE-2026-123206.json | 2 +- data/2026/CVE-2026-123207.json | 2 +- data/2026/CVE-2026-123208.json | 2 +- data/2026/CVE-2026-123271.json | 2 +- data/2026/CVE-2026-123285.json | 2 +- data/2026/CVE-2026-123286.json | 2 +- data/2026/CVE-2026-123287.json | 2 +- data/2026/CVE-2026-123288.json | 2 +- data/2026/CVE-2026-123289.json | 2 +- data/2026/CVE-2026-123290.json | 2 +- data/2026/CVE-2026-123291.json | 2 +- data/2026/CVE-2026-123356.json | 2 +- data/2026/CVE-2026-123367.json | 2 +- data/2026/CVE-2026-123368.json | 2 +- data/2026/CVE-2026-123369.json | 2 +- data/2026/CVE-2026-123370.json | 2 +- data/2026/CVE-2026-123371.json | 2 +- data/2026/CVE-2026-123372.json | 2 +- data/2026/CVE-2026-123373.json | 2 +- data/2026/CVE-2026-123485.json | 2 +- data/2026/CVE-2026-123562.json | 2 +- data/2026/CVE-2026-123563.json | 2 +- data/2026/CVE-2026-123566.json | 2 +- data/2026/CVE-2026-123567.json | 2 +- data/2026/CVE-2026-123610.json | 2 +- data/2026/CVE-2026-123611.json | 2 +- data/2026/CVE-2026-123612.json | 2 +- data/2026/CVE-2026-123614.json | 2 +- data/2026/CVE-2026-123615.json | 2 +- data/2026/CVE-2026-123617.json | 2 +- data/2026/CVE-2026-123618.json | 2 +- data/2026/CVE-2026-123619.json | 2 +- data/2026/CVE-2026-123620.json | 2 +- data/2026/CVE-2026-123621.json | 2 +- data/2026/CVE-2026-123622.json | 2 +- data/2026/CVE-2026-123623.json | 2 +- data/2026/CVE-2026-123784.json | 2 +- data/2026/CVE-2026-123785.json | 2 +- data/2026/CVE-2026-123786.json | 2 +- data/2026/CVE-2026-123796.json | 2 +- data/2026/CVE-2026-123797.json | 2 +- data/2026/CVE-2026-123798.json | 2 +- data/2026/CVE-2026-123799.json | 2 +- data/2026/CVE-2026-123800.json | 2 +- data/2026/CVE-2026-123801.json | 2 +- data/2026/CVE-2026-123802.json | 2 +- data/2026/CVE-2026-123803.json | 2 +- data/2026/CVE-2026-123804.json | 2 +- data/2026/CVE-2026-123806.json | 2 +- data/2026/CVE-2026-123807.json | 2 +- data/2026/CVE-2026-123808.json | 2 +- data/2026/CVE-2026-123809.json | 2 +- data/2026/CVE-2026-123810.json | 2 +- data/2026/CVE-2026-123811.json | 2 +- data/2026/CVE-2026-123812.json | 2 +- data/2026/CVE-2026-123817.json | 2 +- data/2026/CVE-2026-123962.json | 2 +- data/2026/CVE-2026-123973.json | 2 +- data/2026/CVE-2026-123976.json | 2 +- data/2026/CVE-2026-123993.json | 2 +- data/2026/CVE-2026-123994.json | 2 +- data/2026/CVE-2026-123995.json | 2 +- data/2026/CVE-2026-123996.json | 2 +- data/2026/CVE-2026-123997.json | 2 +- data/2026/CVE-2026-123998.json | 2 +- data/2026/CVE-2026-124002.json | 2 +- data/2026/CVE-2026-124003.json | 2 +- data/2026/CVE-2026-124004.json | 2 +- data/2026/CVE-2026-124005.json | 2 +- data/2026/CVE-2026-124006.json | 2 +- data/2026/CVE-2026-124007.json | 2 +- data/2026/CVE-2026-124008.json | 2 +- data/2026/CVE-2026-124009.json | 2 +- data/2026/CVE-2026-124010.json | 2 +- data/2026/CVE-2026-124011.json | 2 +- data/2026/CVE-2026-124012.json | 2 +- data/2026/CVE-2026-124013.json | 2 +- data/2026/CVE-2026-124014.json | 2 +- data/2026/CVE-2026-124015.json | 2 +- data/2026/CVE-2026-124016.json | 2 +- data/2026/CVE-2026-124018.json | 2 +- data/2026/CVE-2026-124025.json | 2 +- data/2026/CVE-2026-124026.json | 2 +- data/2026/CVE-2026-124029.json | 2 +- data/2026/CVE-2026-124039.json | 2 +- data/2026/CVE-2026-124078.json | 2 +- data/2026/CVE-2026-124079.json | 2 +- data/2026/CVE-2026-124307.json | 2 +- data/2026/CVE-2026-124308.json | 2 +- data/2026/CVE-2026-124309.json | 2 +- data/2026/CVE-2026-124311.json | 2 +- data/2026/CVE-2026-124312.json | 2 +- data/2026/CVE-2026-124318.json | 2 +- data/2026/CVE-2026-124437.json | 2 +- data/2026/CVE-2026-124438.json | 2 +- data/2026/CVE-2026-124440.json | 2 +- data/2026/CVE-2026-124441.json | 2 +- data/2026/CVE-2026-124465.json | 2 +- data/2026/CVE-2026-124474.json | 2 +- data/2026/CVE-2026-124491.json | 2 +- data/2026/CVE-2026-124492.json | 2 +- data/2026/CVE-2026-124598.json | 2 +- data/2026/CVE-2026-124599.json | 2 +- data/2026/CVE-2026-124600.json | 2 +- data/2026/CVE-2026-124601.json | 2 +- data/2026/CVE-2026-124602.json | 2 +- data/2026/CVE-2026-124603.json | 2 +- data/2026/CVE-2026-124604.json | 2 +- data/2026/CVE-2026-124684.json | 2 +- data/2026/CVE-2026-125105.json | 2 +- data/2026/CVE-2026-125107.json | 2 +- data/2026/CVE-2026-125113.json | 2 +- data/2026/CVE-2026-125115.json | 2 +- data/2026/CVE-2026-125121.json | 2 +- data/2026/CVE-2026-125122.json | 2 +- data/2026/CVE-2026-125123.json | 2 +- data/2026/CVE-2026-125124.json | 2 +- data/2026/CVE-2026-125125.json | 2 +- data/2026/CVE-2026-125285.json | 2 +- data/2026/CVE-2026-125320.json | 2 +- data/2026/CVE-2026-125321.json | 2 +- data/2026/CVE-2026-125322.json | 2 +- data/2026/CVE-2026-125323.json | 2 +- data/2026/CVE-2026-125325.json | 2 +- data/2026/CVE-2026-125326.json | 2 +- data/2026/CVE-2026-125327.json | 2 +- data/2026/CVE-2026-125328.json | 2 +- data/2026/CVE-2026-125330.json | 2 +- data/2026/CVE-2026-125331.json | 2 +- data/2026/CVE-2026-125337.json | 2 +- data/2026/CVE-2026-125338.json | 2 +- data/2026/CVE-2026-125339.json | 2 +- data/2026/CVE-2026-125340.json | 2 +- data/2026/CVE-2026-125341.json | 2 +- data/2026/CVE-2026-125357.json | 2 +- data/2026/CVE-2026-125358.json | 2 +- data/2026/CVE-2026-125359.json | 2 +- data/2026/CVE-2026-125360.json | 2 +- data/2026/CVE-2026-125361.json | 2 +- data/2026/CVE-2026-125362.json | 2 +- data/2026/CVE-2026-125363.json | 2 +- data/2026/CVE-2026-125364.json | 2 +- data/2026/CVE-2026-125365.json | 2 +- data/2026/CVE-2026-125366.json | 2 +- data/2026/CVE-2026-125367.json | 2 +- data/2026/CVE-2026-125368.json | 2 +- data/2026/CVE-2026-125369.json | 2 +- data/2026/CVE-2026-125373.json | 2 +- data/2026/CVE-2026-125374.json | 2 +- data/2026/CVE-2026-125376.json | 2 +- data/2026/CVE-2026-125378.json | 2 +- data/2026/CVE-2026-125379.json | 2 +- data/2026/CVE-2026-125380.json | 2 +- data/2026/CVE-2026-125381.json | 2 +- data/2026/CVE-2026-125382.json | 2 +- data/2026/CVE-2026-125383.json | 2 +- data/2026/CVE-2026-125384.json | 2 +- data/2026/CVE-2026-125385.json | 2 +- data/2026/CVE-2026-125386.json | 2 +- data/2026/CVE-2026-125387.json | 2 +- data/2026/CVE-2026-125388.json | 2 +- data/2026/CVE-2026-125389.json | 2 +- data/2026/CVE-2026-125390.json | 2 +- data/2026/CVE-2026-125393.json | 2 +- data/2026/CVE-2026-125395.json | 2 +- data/2026/CVE-2026-125396.json | 2 +- data/2026/CVE-2026-125398.json | 2 +- data/2026/CVE-2026-125399.json | 2 +- data/2026/CVE-2026-125400.json | 2 +- data/2026/CVE-2026-125401.json | 2 +- data/2026/CVE-2026-125402.json | 2 +- data/2026/CVE-2026-125404.json | 2 +- data/2026/CVE-2026-125405.json | 2 +- data/2026/CVE-2026-125406.json | 2 +- data/2026/CVE-2026-125637.json | 2 +- data/2026/CVE-2026-125715.json | 2 +- data/2026/CVE-2026-125745.json | 2 +- data/2026/CVE-2026-125747.json | 2 +- data/2026/CVE-2026-125748.json | 2 +- data/2026/CVE-2026-125749.json | 2 +- data/2026/CVE-2026-125750.json | 2 +- data/2026/CVE-2026-125751.json | 2 +- data/2026/CVE-2026-125752.json | 2 +- data/2026/CVE-2026-125753.json | 2 +- data/2026/CVE-2026-125756.json | 2 +- data/2026/CVE-2026-125757.json | 2 +- data/2026/CVE-2026-125758.json | 2 +- data/2026/CVE-2026-125870.json | 2 +- data/2026/CVE-2026-125878.json | 2 +- data/2026/CVE-2026-125879.json | 2 +- data/2026/CVE-2026-125880.json | 2 +- data/2026/CVE-2026-125881.json | 2 +- data/2026/CVE-2026-125882.json | 2 +- data/2026/CVE-2026-125883.json | 2 +- data/2026/CVE-2026-125958.json | 2 +- data/2026/CVE-2026-126048.json | 2 +- data/2026/CVE-2026-126049.json | 2 +- data/2026/CVE-2026-126050.json | 2 +- data/2026/CVE-2026-126061.json | 2 +- data/2026/CVE-2026-126062.json | 2 +- data/2026/CVE-2026-126063.json | 2 +- data/2026/CVE-2026-126064.json | 2 +- data/2026/CVE-2026-126067.json | 2 +- data/2026/CVE-2026-126068.json | 2 +- data/2026/CVE-2026-126069.json | 2 +- data/2026/CVE-2026-126070.json | 2 +- data/2026/CVE-2026-126071.json | 2 +- data/2026/CVE-2026-126072.json | 2 +- data/2026/CVE-2026-126073.json | 2 +- data/2026/CVE-2026-126074.json | 2 +- data/2026/CVE-2026-126075.json | 2 +- data/2026/CVE-2026-126076.json | 2 +- data/2026/CVE-2026-126077.json | 2 +- data/2026/CVE-2026-126078.json | 2 +- data/2026/CVE-2026-126079.json | 2 +- data/2026/CVE-2026-126080.json | 2 +- data/2026/CVE-2026-126081.json | 2 +- data/2026/CVE-2026-126083.json | 2 +- data/2026/CVE-2026-126084.json | 2 +- data/2026/CVE-2026-126085.json | 2 +- data/2026/CVE-2026-126129.json | 2 +- data/2026/CVE-2026-126186.json | 2 +- data/2026/CVE-2026-126187.json | 2 +- data/2026/CVE-2026-126188.json | 2 +- data/2026/CVE-2026-126203.json | 2 +- data/2026/CVE-2026-126204.json | 2 +- data/2026/CVE-2026-126205.json | 1 + data/2026/CVE-2026-126206.json | 1 + data/2026/CVE-2026-126207.json | 1 + data/2026/CVE-2026-126208.json | 1 + data/2026/CVE-2026-126209.json | 1 + data/2026/CVE-2026-126210.json | 1 + data/2026/CVE-2026-126325.json | 2 +- data/2026/CVE-2026-126343.json | 1 + data/2026/CVE-2026-126344.json | 1 + data/2026/CVE-2026-126345.json | 1 + data/2026/CVE-2026-126346.json | 1 + data/2026/CVE-2026-126347.json | 1 + data/2026/CVE-2026-126348.json | 1 + data/2026/CVE-2026-126349.json | 1 + data/2026/CVE-2026-126350.json | 1 + data/2026/CVE-2026-126351.json | 1 + data/2026/CVE-2026-126352.json | 1 + data/2026/CVE-2026-126353.json | 1 + data/2026/CVE-2026-126354.json | 1 + data/2026/CVE-2026-126495.json | 2 +- data/2026/CVE-2026-126498.json | 2 +- data/2026/CVE-2026-126546.json | 2 +- data/2026/CVE-2026-126559.json | 2 +- data/2026/CVE-2026-126561.json | 2 +- data/2026/CVE-2026-126562.json | 2 +- data/2026/CVE-2026-126563.json | 2 +- data/2026/CVE-2026-126565.json | 2 +- data/2026/CVE-2026-126566.json | 2 +- data/2026/CVE-2026-126567.json | 2 +- data/2026/CVE-2026-126569.json | 2 +- data/2026/CVE-2026-126570.json | 2 +- data/2026/CVE-2026-126571.json | 2 +- data/2026/CVE-2026-126641.json | 2 +- data/2026/CVE-2026-126658.json | 2 +- data/2026/CVE-2026-126659.json | 2 +- data/2026/CVE-2026-126766.json | 2 +- data/2026/CVE-2026-126767.json | 2 +- data/2026/CVE-2026-126768.json | 2 +- data/2026/CVE-2026-126769.json | 2 +- data/2026/CVE-2026-126770.json | 2 +- data/2026/CVE-2026-126771.json | 2 +- data/2026/CVE-2026-126772.json | 2 +- data/2026/CVE-2026-126778.json | 2 +- data/2026/CVE-2026-126784.json | 2 +- data/2026/CVE-2026-126793.json | 1 + data/2026/CVE-2026-126797.json | 2 +- data/2026/CVE-2026-126798.json | 2 +- data/2026/CVE-2026-126800.json | 2 +- data/2026/CVE-2026-126801.json | 2 +- data/2026/CVE-2026-126802.json | 2 +- data/2026/CVE-2026-126803.json | 2 +- data/2026/CVE-2026-126807.json | 2 +- data/2026/CVE-2026-126808.json | 2 +- data/2026/CVE-2026-126812.json | 2 +- data/2026/CVE-2026-126814.json | 2 +- data/2026/CVE-2026-126815.json | 2 +- data/2026/CVE-2026-126823.json | 1 + data/2026/CVE-2026-126835.json | 2 +- data/2026/CVE-2026-126837.json | 2 +- data/2026/CVE-2026-126932.json | 2 +- data/2026/CVE-2026-126933.json | 2 +- data/2026/CVE-2026-126934.json | 2 +- data/2026/CVE-2026-126935.json | 2 +- data/2026/CVE-2026-127036.json | 2 +- data/2026/CVE-2026-127050.json | 2 +- data/2026/CVE-2026-127058.json | 2 +- data/2026/CVE-2026-127203.json | 2 +- data/2026/CVE-2026-127206.json | 1 + data/2026/CVE-2026-127207.json | 1 + data/2026/CVE-2026-127208.json | 1 + data/2026/CVE-2026-127209.json | 1 + data/2026/CVE-2026-127211.json | 1 + data/2026/CVE-2026-127235.json | 2 +- data/2026/CVE-2026-127236.json | 2 +- data/2026/CVE-2026-14377.json | 2 +- data/2026/CVE-2026-14661.json | 2 +- data/2026/CVE-2026-14963.json | 2 +- data/2026/CVE-2026-14968.json | 2 +- data/2026/CVE-2026-16118.json | 2 +- data/2026/CVE-2026-16237.json | 2 +- data/2026/CVE-2026-16240.json | 2 +- data/2026/CVE-2026-16433.json | 2 +- data/2026/CVE-2026-16711.json | 2 +- data/2026/CVE-2026-16880.json | 2 +- data/2026/CVE-2026-16918.json | 2 +- data/2026/CVE-2026-17067.json | 2 +- data/2026/CVE-2026-17085.json | 2 +- data/2026/CVE-2026-17128.json | 2 +- data/2026/CVE-2026-17129.json | 2 +- data/2026/CVE-2026-17131.json | 2 +- data/2026/CVE-2026-17132.json | 2 +- data/2026/CVE-2026-17134.json | 2 +- data/2026/CVE-2026-17137.json | 2 +- data/2026/CVE-2026-17139.json | 2 +- data/2026/CVE-2026-17143.json | 2 +- data/2026/CVE-2026-17214.json | 2 +- data/2026/CVE-2026-17230.json | 2 +- data/2026/CVE-2026-17231.json | 2 +- data/2026/CVE-2026-17232.json | 2 +- data/2026/CVE-2026-17237.json | 2 +- data/2026/CVE-2026-17238.json | 2 +- data/2026/CVE-2026-17244.json | 2 +- data/2026/CVE-2026-17288.json | 2 +- data/2026/CVE-2026-17294.json | 2 +- data/2026/CVE-2026-17298.json | 2 +- data/2026/CVE-2026-17305.json | 2 +- data/2026/CVE-2026-17357.json | 2 +- data/2026/CVE-2026-17367.json | 2 +- data/2026/CVE-2026-17369.json | 2 +- data/2026/CVE-2026-17372.json | 2 +- data/2026/CVE-2026-17377.json | 2 +- data/2026/CVE-2026-17379.json | 2 +- data/2026/CVE-2026-17382.json | 2 +- data/2026/CVE-2026-17385.json | 2 +- data/2026/CVE-2026-17396.json | 2 +- data/2026/CVE-2026-17397.json | 2 +- data/2026/CVE-2026-17405.json | 2 +- data/2026/CVE-2026-17406.json | 2 +- data/2026/CVE-2026-18194.json | 2 +- data/2026/CVE-2026-18447.json | 2 +- data/2026/CVE-2026-18448.json | 2 +- data/2026/CVE-2026-18546.json | 2 +- data/2026/CVE-2026-22058.json | 2 +- data/2026/CVE-2026-22060.json | 2 +- data/2026/CVE-2026-2477.json | 2 +- data/2026/CVE-2026-34157.json | 2 +- data/2026/CVE-2026-38595.json | 2 +- data/2026/CVE-2026-38600.json | 2 +- data/2026/CVE-2026-38601.json | 2 +- data/2026/CVE-2026-39379.json | 2 +- data/2026/CVE-2026-39430.json | 2 +- data/2026/CVE-2026-39431.json | 2 +- data/2026/CVE-2026-44266.json | 2 +- data/2026/CVE-2026-44267.json | 2 +- data/2026/CVE-2026-44519.json | 2 +- data/2026/CVE-2026-44875.json | 2 +- data/2026/CVE-2026-45265.json | 2 +- data/2026/CVE-2026-45341.json | 2 +- data/2026/CVE-2026-46350.json | 2 +- data/2026/CVE-2026-46674.json | 2 +- data/2026/CVE-2026-46676.json | 2 +- data/2026/CVE-2026-46677.json | 2 +- data/2026/CVE-2026-47217.json | 2 +- data/2026/CVE-2026-47257.json | 2 +- data/2026/CVE-2026-47258.json | 2 +- data/2026/CVE-2026-47259.json | 2 +- data/2026/CVE-2026-47710.json | 2 +- data/2026/CVE-2026-47711.json | 2 +- data/2026/CVE-2026-47738.json | 2 +- data/2026/CVE-2026-47832.json | 2 +- data/2026/CVE-2026-48057.json | 2 +- data/2026/CVE-2026-52786.json | 2 +- data/2026/CVE-2026-53980.json | 2 +- data/2026/CVE-2026-54912.json | 2 +- data/2026/CVE-2026-54913.json | 2 +- data/2026/CVE-2026-54914.json | 2 +- data/2026/CVE-2026-55186.json | 2 +- data/2026/CVE-2026-55368.json | 2 +- data/2026/CVE-2026-55458.json | 2 +- data/2026/CVE-2026-56712.json | 2 +- data/2026/CVE-2026-56910.json | 2 +- data/2026/CVE-2026-56930.json | 2 +- data/2026/CVE-2026-56951.json | 2 +- data/2026/CVE-2026-56966.json | 2 +- data/2026/CVE-2026-56980.json | 2 +- data/2026/CVE-2026-56995.json | 2 +- data/2026/CVE-2026-57037.json | 2 +- data/2026/CVE-2026-57500.json | 2 +- data/2026/CVE-2026-57853.json | 2 +- data/2026/CVE-2026-58114.json | 2 +- data/2026/CVE-2026-58128.json | 2 +- data/2026/CVE-2026-58141.json | 2 +- data/2026/CVE-2026-58273.json | 2 +- data/2026/CVE-2026-58490.json | 2 +- data/2026/CVE-2026-58505.json | 2 +- data/2026/CVE-2026-58677.json | 2 +- data/2026/CVE-2026-58705.json | 2 +- data/2026/CVE-2026-59082.json | 2 +- data/2026/CVE-2026-59171.json | 2 +- data/2026/CVE-2026-59191.json | 2 +- data/2026/CVE-2026-59192.json | 2 +- data/2026/CVE-2026-59619.json | 2 +- data/2026/CVE-2026-59624.json | 2 +- data/2026/CVE-2026-59625.json | 2 +- data/2026/CVE-2026-59626.json | 2 +- data/2026/CVE-2026-59628.json | 2 +- data/2026/CVE-2026-59636.json | 2 +- data/2026/CVE-2026-59637.json | 2 +- data/2026/CVE-2026-59986.json | 2 +- data/2026/CVE-2026-60117.json | 2 +- data/2026/CVE-2026-61495.json | 2 +- data/2026/CVE-2026-61497.json | 2 +- data/2026/CVE-2026-61547.json | 2 +- data/2026/CVE-2026-61619.json | 2 +- data/2026/CVE-2026-61637.json | 2 +- data/2026/CVE-2026-61810.json | 2 +- data/2026/CVE-2026-61812.json | 2 +- data/2026/CVE-2026-62268.json | 2 +- data/2026/CVE-2026-62344.json | 2 +- data/2026/CVE-2026-62345.json | 2 +- data/2026/CVE-2026-62346.json | 2 +- data/2026/CVE-2026-62662.json | 2 +- data/2026/CVE-2026-62850.json | 2 +- data/2026/CVE-2026-62851.json | 2 +- data/2026/CVE-2026-62852.json | 2 +- data/2026/CVE-2026-62854.json | 2 +- data/2026/CVE-2026-62856.json | 2 +- data/2026/CVE-2026-62971.json | 2 +- data/2026/CVE-2026-63010.json | 2 +- data/2026/CVE-2026-63011.json | 2 +- data/2026/CVE-2026-63017.json | 2 +- data/2026/CVE-2026-63192.json | 2 +- data/2026/CVE-2026-63194.json | 2 +- data/2026/CVE-2026-63197.json | 2 +- data/2026/CVE-2026-63198.json | 2 +- data/2026/CVE-2026-63433.json | 2 +- data/2026/CVE-2026-63434.json | 2 +- data/2026/CVE-2026-63437.json | 2 +- data/2026/CVE-2026-63438.json | 2 +- data/2026/CVE-2026-63439.json | 2 +- data/2026/CVE-2026-63440.json | 2 +- data/2026/CVE-2026-63441.json | 2 +- data/2026/CVE-2026-63496.json | 2 +- data/2026/CVE-2026-63501.json | 2 +- data/2026/CVE-2026-63540.json | 2 +- data/2026/CVE-2026-63634.json | 2 +- data/2026/CVE-2026-63651.json | 2 +- data/2026/CVE-2026-63653.json | 2 +- data/2026/CVE-2026-63660.json | 2 +- data/2026/CVE-2026-63774.json | 2 +- data/2026/CVE-2026-64481.json | 2 +- data/2026/CVE-2026-64485.json | 2 +- data/2026/CVE-2026-64490.json | 2 +- data/2026/CVE-2026-64496.json | 2 +- data/2026/CVE-2026-64515.json | 2 +- data/2026/CVE-2026-64522.json | 2 +- data/2026/CVE-2026-64523.json | 2 +- data/2026/CVE-2026-64524.json | 2 +- data/2026/CVE-2026-64529.json | 2 +- data/2026/CVE-2026-64531.json | 2 +- data/2026/CVE-2026-64532.json | 2 +- data/2026/CVE-2026-6460.json | 2 +- data/2026/CVE-2026-64668.json | 2 +- data/2026/CVE-2026-6467.json | 2 +- data/2026/CVE-2026-64678.json | 2 +- data/2026/CVE-2026-64682.json | 2 +- data/2026/CVE-2026-64686.json | 2 +- data/2026/CVE-2026-64855.json | 2 +- data/2026/CVE-2026-64858.json | 2 +- data/2026/CVE-2026-64860.json | 2 +- data/2026/CVE-2026-65022.json | 2 +- data/2026/CVE-2026-65820.json | 2 +- data/2026/CVE-2026-65833.json | 2 +- data/2026/CVE-2026-65840.json | 2 +- data/2026/CVE-2026-65843.json | 2 +- data/2026/CVE-2026-65949.json | 2 +- data/2026/CVE-2026-65950.json | 2 +- data/2026/CVE-2026-65951.json | 2 +- data/2026/CVE-2026-65952.json | 2 +- data/2026/CVE-2026-65957.json | 2 +- data/2026/CVE-2026-65960.json | 2 +- data/2026/CVE-2026-65965.json | 2 +- data/2026/CVE-2026-65967.json | 2 +- data/2026/CVE-2026-65968.json | 2 +- data/2026/CVE-2026-65971.json | 2 +- data/2026/CVE-2026-65973.json | 2 +- data/2026/CVE-2026-65982.json | 2 +- data/2026/CVE-2026-67449.json | 2 +- data/2026/CVE-2026-67547.json | 2 +- data/2026/CVE-2026-67548.json | 2 +- data/2026/CVE-2026-68507.json | 2 +- data/2026/CVE-2026-68509.json | 2 +- data/2026/CVE-2026-68511.json | 2 +- data/2026/CVE-2026-68512.json | 2 +- data/2026/CVE-2026-68549.json | 2 +- data/2026/CVE-2026-70555.json | 2 +- data/2026/CVE-2026-70660.json | 2 +- data/2026/CVE-2026-71495.json | 2 +- data/2026/CVE-2026-71863.json | 2 +- data/2026/CVE-2026-73856.json | 2 +- data/2026/CVE-2026-73857.json | 2 +- data/2026/CVE-2026-75599.json | 2 +- data/2026/CVE-2026-75614.json | 2 +- data/2026/CVE-2026-75615.json | 2 +- data/2026/CVE-2026-77153.json | 2 +- data/2026/CVE-2026-77299.json | 2 +- data/2026/CVE-2026-77372.json | 2 +- data/2026/CVE-2026-77442.json | 2 +- data/2026/CVE-2026-77463.json | 2 +- data/2026/CVE-2026-77473.json | 2 +- data/2026/CVE-2026-77604.json | 2 +- data/2026/CVE-2026-77622.json | 2 +- data/2026/CVE-2026-77873.json | 2 +- data/2026/CVE-2026-77882.json | 2 +- data/2026/CVE-2026-79405.json | 2 +- data/2026/CVE-2026-80301.json | 2 +- data/2026/CVE-2026-80302.json | 2 +- data/2026/CVE-2026-80303.json | 2 +- data/2026/CVE-2026-80335.json | 2 +- data/2026/CVE-2026-81190.json | 2 +- data/2026/CVE-2026-81542.json | 2 +- data/2026/CVE-2026-81936.json | 2 +- data/2026/CVE-2026-82029.json | 2 +- data/2026/CVE-2026-82033.json | 2 +- data/2026/CVE-2026-82292.json | 2 +- data/2026/CVE-2026-82509.json | 2 +- data/2026/CVE-2026-82518.json | 2 +- data/2026/CVE-2026-82977.json | 2 +- data/2026/CVE-2026-8331.json | 2 +- data/2026/CVE-2026-8332.json | 2 +- data/2026/CVE-2026-8333.json | 2 +- data/2026/CVE-2026-84237.json | 2 +- data/2026/CVE-2026-85068.json | 2 +- data/2026/CVE-2026-85076.json | 2 +- data/2026/CVE-2026-85287.json | 2 +- data/2026/CVE-2026-85737.json | 2 +- data/2026/CVE-2026-85742.json | 2 +- data/2026/CVE-2026-85743.json | 2 +- data/2026/CVE-2026-85744.json | 2 +- data/2026/CVE-2026-86041.json | 2 +- data/2026/CVE-2026-86044.json | 2 +- data/2026/CVE-2026-86322.json | 1 + data/2026/CVE-2026-86323.json | 1 + data/2026/CVE-2026-86324.json | 1 + data/2026/CVE-2026-87008.json | 2 +- data/2026/CVE-2026-87857.json | 2 +- data/2026/CVE-2026-88217.json | 2 +- data/2026/CVE-2026-89017.json | 2 +- data/2026/CVE-2026-89061.json | 2 +- data/2026/CVE-2026-89125.json | 2 +- data/2026/CVE-2026-90908.json | 2 +- data/2026/CVE-2026-91000.json | 2 +- data/2026/CVE-2026-91141.json | 1 + data/2026/CVE-2026-92683.json | 2 +- data/2026/CVE-2026-92684.json | 2 +- data/2026/CVE-2026-94618.json | 2 +- data/2026/CVE-2026-94619.json | 2 +- data/2026/CVE-2026-95405.json | 2 +- data/2026/CVE-2026-95651.json | 2 +- data/2026/CVE-2026-95778.json | 2 +- data/2026/CVE-2026-95779.json | 2 +- data/2026/CVE-2026-95780.json | 2 +- data/2026/CVE-2026-95781.json | 2 +- data/2026/CVE-2026-95782.json | 2 +- data/2026/CVE-2026-95783.json | 2 +- data/2026/CVE-2026-95784.json | 2 +- data/2026/CVE-2026-95785.json | 2 +- data/2026/CVE-2026-95786.json | 2 +- data/2026/CVE-2026-95948.json | 2 +- data/2026/CVE-2026-95953.json | 2 +- data/2026/CVE-2026-96150.json | 2 +- data/2026/CVE-2026-97033.json | 2 +- data/2026/CVE-2026-97034.json | 2 +- data/2026/CVE-2026-97035.json | 2 +- data/2026/CVE-2026-97036.json | 2 +- data/2026/CVE-2026-97037.json | 2 +- data/2026/CVE-2026-97038.json | 2 +- data/2026/CVE-2026-97039.json | 2 +- data/2026/CVE-2026-97040.json | 2 +- data/2026/CVE-2026-97041.json | 2 +- data/2026/CVE-2026-97042.json | 2 +- data/2026/CVE-2026-97043.json | 2 +- data/2026/CVE-2026-97054.json | 2 +- data/2026/CVE-2026-97702.json | 2 +- data/2026/CVE-2026-97705.json | 2 +- data/2026/CVE-2026-97845.json | 2 +- state/sync.json | 2 +- 889 files changed, 889 insertions(+), 859 deletions(-) create mode 100644 data/2026/CVE-2026-106018.json create mode 100644 data/2026/CVE-2026-126205.json create mode 100644 data/2026/CVE-2026-126206.json create mode 100644 data/2026/CVE-2026-126207.json create mode 100644 data/2026/CVE-2026-126208.json create mode 100644 data/2026/CVE-2026-126209.json create mode 100644 data/2026/CVE-2026-126210.json create mode 100644 data/2026/CVE-2026-126343.json create mode 100644 data/2026/CVE-2026-126344.json create mode 100644 data/2026/CVE-2026-126345.json create mode 100644 data/2026/CVE-2026-126346.json create mode 100644 data/2026/CVE-2026-126347.json create mode 100644 data/2026/CVE-2026-126348.json create mode 100644 data/2026/CVE-2026-126349.json create mode 100644 data/2026/CVE-2026-126350.json create mode 100644 data/2026/CVE-2026-126351.json create mode 100644 data/2026/CVE-2026-126352.json create mode 100644 data/2026/CVE-2026-126353.json create mode 100644 data/2026/CVE-2026-126354.json create mode 100644 data/2026/CVE-2026-126793.json create mode 100644 data/2026/CVE-2026-126823.json create mode 100644 data/2026/CVE-2026-127206.json create mode 100644 data/2026/CVE-2026-127207.json create mode 100644 data/2026/CVE-2026-127208.json create mode 100644 data/2026/CVE-2026-127209.json create mode 100644 data/2026/CVE-2026-127211.json create mode 100644 data/2026/CVE-2026-86322.json create mode 100644 data/2026/CVE-2026-86323.json create mode 100644 data/2026/CVE-2026-86324.json create mode 100644 data/2026/CVE-2026-91141.json diff --git a/data/2017/CVE-2017-20251.json b/data/2017/CVE-2017-20251.json index 4bc7d8ea44..c8b8c4034a 100644 --- a/data/2017/CVE-2017-20251.json +++ b/data/2017/CVE-2017-20251.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Woody Code Snippets","vendor":"Themeisle","versions":[{"lessThan":"3.3.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server."},{"lang":"es","value":"Las versiones del plugin WordPress Insert PHP anteriores a la 3.3.1 contienen una vulnerabilidad de inyección de código PHP que permite a atacantes no autenticados ejecutar código PHP arbitrario inyectando shortcodes maliciosos a través de la API REST de WordPress. Los atacantes pueden enviar solicitudes POST al endpoint wp-json/wp/v2/posts con contenido manipulado que contenga shortcodes insert_php para incluir y ejecutar archivos PHP remotos en el servidor."}],"id":"CVE-2017-20251","lastModified":"2026-07-21T07:10:00.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2017-20251","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T16:13:44.753300Z","version":"2.0.3"}}]},"published":"2026-06-09T13:16:35.140","references":[{"source":"disclosure@vulncheck.com","url":"https://fr.wordpress.org/plugins/insert-php/"},{"source":"disclosure@vulncheck.com","url":"https://www.exploit-db.com/exploits/41308"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Woody Code Snippets","vendor":"Themeisle","versions":[{"lessThan":"2.5.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"WordPress Insert PHP plugin versions before 2.5.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server."},{"lang":"es","value":"Las versiones del plugin WordPress Insert PHP anteriores a la 3.3.1 contienen una vulnerabilidad de inyección de código PHP que permite a atacantes no autenticados ejecutar código PHP arbitrario inyectando shortcodes maliciosos a través de la API REST de WordPress. Los atacantes pueden enviar solicitudes POST al endpoint wp-json/wp/v2/posts con contenido manipulado que contenga shortcodes insert_php para incluir y ejecutar archivos PHP remotos en el servidor."}],"id":"CVE-2017-20251","lastModified":"2026-11-12T22:17:32.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2017-20251","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T16:13:44.753300Z","version":"2.0.3"}}]},"published":"2026-06-09T13:16:35.140","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/insert-php/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.exploit-db.com/exploits/41308"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wordpress-insert-php-plugin-php-code-injection-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2022/CVE-2022-29966.json b/data/2022/CVE-2022-29966.json index 6c43f9cc98..ac12742d39 100644 --- a/data/2022/CVE-2022-29966.json +++ b/data/2022/CVE-2022-29966.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition."}],"id":"CVE-2022-29966","lastModified":"2026-11-06T19:17:01.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-29966","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:07:42.850084Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:20.353","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition."}],"id":"CVE-2022-29966","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-29966","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:07:42.850084Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:20.353","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]} diff --git a/data/2022/CVE-2022-30267.json b/data/2022/CVE-2022-30267.json index a139c9448d..b4af96a4d1 100644 --- a/data/2022/CVE-2022-30267.json +++ b/data/2022/CVE-2022-30267.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution."}],"id":"CVE-2022-30267","lastModified":"2026-11-06T19:17:01.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-30267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:06:59.602514Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:21.860","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Ovation","vendor":"Emerson","versions":[{"lessThanOrEqual":"Version 3.8.0 Feature Pack 1","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"3.8.0 Feature Pack 3"}]}],"source":"ics-cert@hq.dhs.gov"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Emerson Ovation \nwas found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution."}],"id":"CVE-2022-30267","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"ics-cert@hq.dhs.gov","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-30267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:06:59.602514Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:21.860","references":[{"source":"ics-cert@hq.dhs.gov","url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2024/icsa-24-158-02.json"},{"source":"ics-cert@hq.dhs.gov","url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-158-02"}],"sourceIdentifier":"ics-cert@hq.dhs.gov","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"ics-cert@hq.dhs.gov","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-21963.json b/data/2024/CVE-2024-21963.json index fa224aec8b..4d01c5aede 100644 --- a/data/2024/CVE-2024-21963.json +++ b/data/2024/CVE-2024-21963.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0k"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Series","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6 1.0.0.Ed"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bf"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7f"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1PI 1.0.0.3j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2.b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1m"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 2000 Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z1 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.3"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000A Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedV2KAPI-FP6 1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.1.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen Embedded V3000 EDKII Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability."}],"id":"CVE-2024-21963","lastModified":"2026-11-12T20:18:09.523","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:09.523","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3060.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-524.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 7001 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 4005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 8005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0k"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000HX Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"FireRangeFL1PI 1.0.0.0c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.0d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI Max 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixHaloPI-FP11_1.0.0.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 9000 Series","vendor":"AMD","versions":[{"status":"unaffected","version":"ShimadaPeakPI-SP6 1.0.0.1b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z2 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.0e"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6 1.0.0.Ed"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.Bf"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7f"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1PI 1.0.0.3j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ AI 300 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StrixKrackanPI-FP8_1.1.0.2.b"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6 1.0.0.1m"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 2000 Mobile Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Z1 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.2.0.3g"},{"status":"unaffected","version":"ComboAM5 1.0.0.c"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7002 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 7003 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Genoa\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.3"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000A Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedV2KAPI-FP6 1.0.0.A"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.1.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen Embedded V3000 EDKII Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1.0.0.D"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed \"Bergamo\")","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 8004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Linux kernel upstream"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and potentially cause a host crash leading to loss of availability."}],"id":"CVE-2024-21963","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:09.523","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3060.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/10/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://xenbits.xen.org/xsa/advisory-524.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-36344.json b/data/2024/CVE-2024-36344.json index 318ea8fea2..1a78100c4c 100644 --- a/data/2024/CVE-2024-36344.json +++ b/data/2024/CVE-2024-36344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.6"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5PI 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"},{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4PI 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedR2KPI-FP5 1006"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.4​"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1011"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbTurinPI-SP5_1.0.0.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.2"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI210","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI250","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300A","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI308","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI325X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V520","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V620","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V710","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service."}],"id":"CVE-2024-36344","lastModified":"2026-11-12T20:18:12.150","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:12.150","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3057.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6028.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 4004 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"}]},{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI 1.0.0.6"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RenoirPI-FP6_1.0.0.Ec"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"MendocinoPI-FT6_1.0.0.7c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"DragonRangeFL1 1.0.0.3h"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI_1.0.0.B"},{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5PI 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"},{"status":"unaffected","version":"CastlePeakWSPI-sWRX8 1.0.0.H"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 3000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"CastlePeakPI-SP3r3_1.0.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 5000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ChagallWSPI-sWRX8 1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ 7000 Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Threadripper™ PRO 7000 WX-Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"StormPeakPI-SP6_1.0.0.1l"},{"status":"unaffected","version":"StormPeakPI-SP6_1.1.0.0j"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5PI 1.1.0.3d"},{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 9000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM5 1.2.0.3d"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"CezannePI-FP6_1.0.1.1c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 4000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2 1.2.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4v2PI_1.2.0.F"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Desktop Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"ComboAM4PI 1.0.0.10"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PhoenixPI-FP8-FP7_1.2.0.B"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"PicassoPI-FP5_1.0.1.2c"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics","vendor":"AMD","versions":[{"status":"unaffected","version":"RembrandtPI-FP7_1.0.0.BD"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R1000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded R2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedR2KPI-FP5 1006"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V1000 Series Processors (formerly codenamed \"Raven Ridge\")","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP5 1211"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 5000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbAM4PI 1.0.0.9"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 7000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.4​"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V2000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPI-FP6_1.0.0.C"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded V3000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"Embedded-PI_FP7r2 1011"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbTurinPI-SP5_1.0.0.1"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 8000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedPhoenixPI-FP7r2_1.0.0.2"}]},{"defaultStatus":"affected","product":"AMD Ryzen™ Embedded 9000 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedAM5PI 1.0.0.5"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W5000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ RX 7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: Adrenalin Edition 25.5.1 (25.10.01.09)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W6000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO W7000 Series Graphics Products","vendor":"AMD","versions":[{"status":"unaffected","version":"AMD Software: PRO Edition 25.Q2 (25.10.10)"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI210","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI250","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300A","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI300X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI308","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Instinct™ MI325X","vendor":"AMD","versions":[{"status":"unaffected","version":"AMDGPU Driver 25.10"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V520","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V620","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]},{"defaultStatus":"affected","product":"AMD Radeon™ PRO V710","vendor":"AMD","versions":[{"status":"unaffected","version":"Contact your AMD Customer Engineering representative"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access to the Trusted Execution Environment (TEE) interface or Trusted Application (TA) to cause an out-of-bounds write, potentially resulting in a loss of platform integrity or denial of service."}],"id":"CVE-2024-36344","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:12.150","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3057.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4018.html"},{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6028.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2024/CVE-2024-41786.json b/data/2024/CVE-2024-41786.json index 0db1ae3d47..828c85e15c 100644 --- a/data/2024/CVE-2024-41786.json +++ b/data/2024/CVE-2024-41786.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.2:*:*:*:*:*:*:*"],"product":"Engineering Requirements Management DOORS Next","vendor":"IBM","versions":[{"status":"affected","version":"7.1"},{"status":"affected","version":"7.2"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation."},{"lang":"es","value":"IBM Engineering Requirements Management DOORS Next 7.1 y 7.2 podría permitir a un atacante remoto forzar al servidor web a devolver el contenido de un archivo solicitado sensible debido a una validación de entrada incorrecta."}],"id":"CVE-2024-41786","lastModified":"2026-11-09T10:10:00.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T16:16:35.413","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294385"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-213"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:engineering_requirements_management_doors_next:7.2:*:*:*:*:*:*:*"],"product":"Engineering Requirements Management DOORS Next","vendor":"IBM","versions":[{"status":"affected","version":"7.1"},{"status":"affected","version":"7.2"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation."},{"lang":"es","value":"IBM Engineering Requirements Management DOORS Next 7.1 y 7.2 podría permitir a un atacante remoto forzar al servidor web a devolver el contenido de un archivo solicitado sensible debido a una validación de entrada incorrecta."}],"id":"CVE-2024-41786","lastModified":"2026-11-12T21:17:15.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-41786","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:10:38.575581Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.413","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294385"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-213"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-0043.json b/data/2025/CVE-2025-0043.json index e432ee9072..92e5d3b4b8 100644 --- a/data/2025/CVE-2025-0043.json +++ b/data/2025/CVE-2025-0043.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."}],"id":"CVE-2025-0043","lastModified":"2026-11-12T20:18:13.827","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Vivado Software","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, potentially resulting in arbitrary code execution."}],"id":"CVE-2025-0043","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:13.827","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8024.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-10935.json b/data/2025/CVE-2025-10935.json index 666c8d5fd2..caeb95dfe9 100644 --- a/data/2025/CVE-2025-10935.json +++ b/data/2025/CVE-2025-10935.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-12T03:17:08.107","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"libilbm","vendor":"libilbm","versions":[{"status":"affected","version":"3.0.4"}]}],"source":"zdi-disclosures@trendmicro.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libilbm ILBM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libilbm. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of ILBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27792."}],"id":"CVE-2025-10935","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]},"published":"2026-11-12T03:17:08.107","references":[{"source":"zdi-disclosures@trendmicro.com","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-887/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"zdi-disclosures@trendmicro.com","type":"Primary"}]} diff --git a/data/2025/CVE-2025-11229.json b/data/2025/CVE-2025-11229.json index 41f28d55f5..bb601733d4 100644 --- a/data/2025/CVE-2025-11229.json +++ b/data/2025/CVE-2025-11229.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"7.0.0.125","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.32","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"WSO2 Identity Application Management Component","vendor":"WSO2","versions":[{"lessThan":"7.0.78.137","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThan":"7.8.23.49","status":"affected","version":"7.8.23","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.\n\nExploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state."},{"lang":"es","value":"El sistema no aplica correctamente la autorización de alcance cuando la configuración “authorize_all_scopes” está habilitada. Esto permite que las aplicaciones que utilizan el tipo de concesión de credenciales de cliente obtengan todos los alcances de la API, incluidos los alcances internos y de consola sensibles, sin requerir autorización explícita, eludiendo los controles de acceso previstos.\n\nLa explotación de esta vulnerabilidad puede conducir a una escalada de privilegios, permitiendo a los clientes sin privilegios realizar acciones administrativas no autorizadas, acceder a datos organizacionales confidenciales y, potencialmente, lograr una toma de control completa de la cuenta en implementaciones donde la configuración “authorize_all_scopes” se desvía de su estado deshabilitado predeterminado."}],"id":"CVE-2025-11229","lastModified":"2026-11-09T22:18:20.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:28:59.481681Z","version":"2.0.3"}}]},"published":"2026-11-04T06:16:54.070","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"7.0.0.125","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.32","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"WSO2 Identity Application Management Component","vendor":"WSO2","versions":[{"lessThan":"7.0.78.137","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThan":"7.8.23.49","status":"affected","version":"7.8.23","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.\n\nExploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state."},{"lang":"es","value":"El sistema no aplica correctamente la autorización de alcance cuando la configuración “authorize_all_scopes” está habilitada. Esto permite que las aplicaciones que utilizan el tipo de concesión de credenciales de cliente obtengan todos los alcances de la API, incluidos los alcances internos y de consola sensibles, sin requerir autorización explícita, eludiendo los controles de acceso previstos.\n\nLa explotación de esta vulnerabilidad puede conducir a una escalada de privilegios, permitiendo a los clientes sin privilegios realizar acciones administrativas no autorizadas, acceder a datos organizacionales confidenciales y, potencialmente, lograr una toma de control completa de la cuenta en implementaciones donde la configuración “authorize_all_scopes” se desvía de su estado deshabilitado predeterminado."}],"id":"CVE-2025-11229","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11229","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:28:59.481681Z","version":"2.0.3"}}]},"published":"2026-11-04T06:16:54.070","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4525/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-54507.json b/data/2025/CVE-2025-54507.json index b75946ec8f..6f34e93977 100644 --- a/data/2025/CVE-2025-54507.json +++ b/data/2025/CVE-2025-54507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54507","lastModified":"2026-11-12T20:18:14.030","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"AMD EPYC™ 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"TurinPI_1.0.0.8"}]},{"defaultStatus":"affected","product":"AMD EPYC™ Embedded 9005 Series Processors","vendor":"AMD","versions":[{"status":"unaffected","version":"EmbeddedTurinPI_SP5_1004"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administrative privileges to create multiple RMP entries for the same guest physical address, potentially resulting in loss of guest integrity."}],"id":"CVE-2025-54507","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.030","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3058.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1288"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-55002.json b/data/2025/CVE-2025-55002.json index 6ef3a85a4d..b2ac9d5235 100644 --- a/data/2025/CVE-2025-55002.json +++ b/data/2025/CVE-2025-55002.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1, JupyterLab Desktop para macOS se distribuía con el fusible RunAsNode de Electron habilitado, lo que permitía a ELECTRON_RUN_AS_NODE ejecutar código Node.js arbitrario en el proceso de la aplicación. Un atacante que ya puede ejecutar código como el usuario actual puede, por lo tanto, ejecutar código en el contexto de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluyendo el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere una ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial o remota. Windows y Linux no se ven afectados. Esta vulnerabilidad está corregida en la versión 4.6.2-1."}],"id":"CVE-2025-55002","lastModified":"2026-11-11T05:19:13.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-55002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:29:38.969959Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.390","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."},{"lang":"es","value":"JupyterLab Desktop es la aplicación de escritorio multiplataforma para JupyterLab. Versiones anteriores a la 4.6.2-1, JupyterLab Desktop para macOS se distribuía con el fusible RunAsNode de Electron habilitado, lo que permitía a ELECTRON_RUN_AS_NODE ejecutar código Node.js arbitrario en el proceso de la aplicación. Un atacante que ya puede ejecutar código como el usuario actual puede, por lo tanto, ejecutar código en el contexto de JupyterLab Desktop y heredar los permisos TCC previamente otorgados a la aplicación, incluyendo el acceso a las carpetas protegidas de Documentos, Escritorio o Descargas sin otra solicitud de macOS. La explotación requiere una ejecución de código local existente y concesiones TCC previas; no proporciona ejecución de código inicial o remota. Windows y Linux no se ven afectados. Esta vulnerabilidad está corregida en la versión 4.6.2-1."}],"id":"CVE-2025-55002","lastModified":"2026-11-12T22:10:38.507","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-55002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:29:38.969959Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:04.390","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-250"},{"lang":"en","value":"CWE-693"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-59847.json b/data/2025/CVE-2025-59847.json index f461359009..519d6ee5fd 100644 --- a/data/2025/CVE-2025-59847.json +++ b/data/2025/CVE-2025-59847.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59847","lastModified":"2026-11-11T08:17:16.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Domino Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"1.1.66 - 1.1.9"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59847","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.427","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134535"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-59848.json b/data/2025/CVE-2025-59848.json index c7deef6645..074b355c7a 100644 --- a/data/2025/CVE-2025-59848.json +++ b/data/2025/CVE-2025-59848.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59848","lastModified":"2026-11-11T08:17:16.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"HCL Leap","vendor":"HCL Software","versions":[{"status":"affected","version":"9.3.88 - 9.2.10"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session"}],"id":"CVE-2025-59848","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":5.9,"source":"psirt@hcl.com","type":"Secondary"}]},"published":"2026-11-11T08:17:16.603","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134534"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"psirt@hcl.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71451.json b/data/2025/CVE-2025-71451.json index c6d40cb502..e6920e6369 100644 --- a/data/2025/CVE-2025-71451.json +++ b/data/2025/CVE-2025-71451.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/serverside/serverbackupprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como ClientName, BackupName y grpName que se interpolan sin sanear en llamadas a loadXMLDoc() y se reflejan en solicitudes POST de AbortBackup() a dodeleteclientbackup.sgp. Los atacantes pueden crear enlaces o solicitudes maliciosas para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71451","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71451","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:28:15.713821Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.470","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/serverside/serverbackupprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as ClientName, BackupName, and grpName that are interpolated unsanitized into loadXMLDoc() calls and reflected in AbortBackup() POST requests to dodeleteclientbackup.sgp. Attackers can craft malicious links or requests to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/serverside/serverbackupprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como ClientName, BackupName y grpName que se interpolan sin sanear en llamadas a loadXMLDoc() y se reflejan en solicitudes POST de AbortBackup() a dodeleteclientbackup.sgp. Los atacantes pueden crear enlaces o solicitudes maliciosas para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71451","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71451","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:28:15.713821Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.470","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-serverbackupprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71452.json b/data/2025/CVE-2025-71452.json index 3f27c9482b..bda62eeee8 100644 --- a/data/2025/CVE-2025-71452.json +++ b/data/2025/CVE-2025-71452.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la versión 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/clientside/restoreprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como mn, rnm, isRepliRestore, rusr y rpwd, los cuales se reflejan sin sanitizar en la respuesta HTML. Los atacantes pueden crear enlaces maliciosos para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71452","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:43:28.447757Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.643","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BDRSuite","vendor":"Vembu Technologies","versions":[{"lessThan":"7.6.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are reflected unsanitized into the HTML response. Attackers can craft malicious links to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking or interface manipulation."},{"lang":"es","value":"Vembu BDRSuite anterior a la versión 7.6.0 contiene una vulnerabilidad de Cross-site Scripting (XSS) no autenticado en templates/progress/clientside/restoreprogress.sgp que permite a atacantes remotos inyectar JavaScript arbitrario manipulando parámetros de solicitud como mn, rnm, isRepliRestore, rusr y rpwd, los cuales se reflejan sin sanitizar en la respuesta HTML. Los atacantes pueden crear enlaces maliciosos para ejecutar JavaScript arbitrario en la sesión del navegador de una víctima, lo que permite el secuestro de sesión o la manipulación de la interfaz."}],"id":"CVE-2025-71452","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:43:28.447757Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:05.643","references":[{"source":"disclosure@vulncheck.com","url":"https://chocapikk.com/posts/2025/bdrsuite/"},{"source":"disclosure@vulncheck.com","url":"https://support.bdrshield.com/portal/en/kb/articles/release-notes"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vembu-bdrsuite-xss-via-restoreprogress-sgp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71453.json b/data/2025/CVE-2025-71453.json index a6e7722be1..4532d1cf4d 100644 --- a/data/2025/CVE-2025-71453.json +++ b/data/2025/CVE-2025-71453.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."},{"lang":"es","value":"vtenext versiones anteriores a la 25.02.2 contiene una vulnerabilidad de Cross-site Scripting (XSS) reflejado en modules/Home/HomeWidgetBlockList.php que devuelve claves ’widgetId’ no saneadas del parámetro JSON ’widgetInfoList’. Los atacantes pueden inducir a un usuario autenticado a enviar una solicitud POST manipulada con HTML en las claves ’widgetId’, ejecutando JavaScript en la sesión de vtenext de la víctima."}],"id":"CVE-2025-71453","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."},{"lang":"es","value":"vtenext versiones anteriores a la 25.02.2 contiene una vulnerabilidad de Cross-site Scripting (XSS) reflejado en modules/Home/HomeWidgetBlockList.php que devuelve claves ’widgetId’ no saneadas del parámetro JSON ’widgetInfoList’. Los atacantes pueden inducir a un usuario autenticado a enviar una solicitud POST manipulada con HTML en las claves ’widgetId’, ejecutando JavaScript en la sesión de vtenext de la víctima."}],"id":"CVE-2025-71453","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71454.json b/data/2025/CVE-2025-71454.json index c39e9b473e..26a2d5fe27 100644 --- a/data/2025/CVE-2025-71454.json +++ b/data/2025/CVE-2025-71454.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene un bypass de la protección contra falsificación de petición en sitios cruzados (CSRF) porque csrf_check() en include/utils/VteCsrf.php omite la validación del token __csrf_token para peticiones que no son POST. Los atacantes pueden inducir a un usuario autenticado a abrir un enlace manipulado que envía peticiones GET que cambian el estado, las cuales los manejadores leen de $_REQUEST, realizando acciones como ese usuario."}],"id":"CVE-2025-71454","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71454","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:05:52.954478Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.840","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-csrf-protection-bypass-via-http-method-tampering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene un bypass de la protección contra falsificación de petición en sitios cruzados (CSRF) porque csrf_check() en include/utils/VteCsrf.php omite la validación del token __csrf_token para peticiones que no son POST. Los atacantes pueden inducir a un usuario autenticado a abrir un enlace manipulado que envía peticiones GET que cambian el estado, las cuales los manejadores leen de $_REQUEST, realizando acciones como ese usuario."}],"id":"CVE-2025-71454","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71454","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:05:52.954478Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.840","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-csrf-protection-bypass-via-http-method-tampering"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71455.json b/data/2025/CVE-2025-71455.json index 2fbc7a0183..43039ce11b 100644 --- a/data/2025/CVE-2025-71455.json +++ b/data/2025/CVE-2025-71455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene una vulnerabilidad de divulgación de identificador de sesión que permite a los atacantes leer el valor PHPSESSID devuelto por el endpoint del servicio web Touch. Los atacantes que pueden ejecutar scripts en el origen de vtenext, como a través de Cross-site Scripting (XSS), pueden eludir la bandera HttpOnly y secuestrar sesiones autenticadas."}],"id":"CVE-2025-71455","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:23:26.787003Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.017","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions."},{"lang":"es","value":"vtenext anterior a la versión 25.02.2 contiene una vulnerabilidad de divulgación de identificador de sesión que permite a los atacantes leer el valor PHPSESSID devuelto por el endpoint del servicio web Touch. Los atacantes que pueden ejecutar scripts en el origen de vtenext, como a través de Cross-site Scripting (XSS), pueden eludir la bandera HttpOnly y secuestrar sesiones autenticadas."}],"id":"CVE-2025-71455","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71455","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:23:26.787003Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.017","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-session-identifier-disclosure-via-touch-web-service"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71456.json b/data/2025/CVE-2025-71456.json index 832da97c23..9db6892c34 100644 --- a/data/2025/CVE-2025-71456.json +++ b/data/2025/CVE-2025-71456.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts."},{"lang":"es","value":"vtenext en versiones anteriores a la 25.02.2 contiene una vulnerabilidad de inyección SQL que permite a usuarios autenticados con bajos privilegios inyectar SQL al proporcionar un parámetro ’fieldname’ manipulado a modules/Fax/EditView.php. Los atacantes pueden leer contenido arbitrario de la base de datos, incluyendo tokens de restablecimiento de contraseña almacenados en vte_userauthtoken, para tomar el control de otras cuentas de usuario."}],"id":"CVE-2025-71456","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71456","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:24:36.654277Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.183","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-sql-injection-via-fieldname-in-fax-editview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts."},{"lang":"es","value":"vtenext en versiones anteriores a la 25.02.2 contiene una vulnerabilidad de inyección SQL que permite a usuarios autenticados con bajos privilegios inyectar SQL al proporcionar un parámetro ’fieldname’ manipulado a modules/Fax/EditView.php. Los atacantes pueden leer contenido arbitrario de la base de datos, incluyendo tokens de restablecimiento de contraseña almacenados en vte_userauthtoken, para tomar el control de otras cuentas de usuario."}],"id":"CVE-2025-71456","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71456","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:24:36.654277Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.183","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-sql-injection-via-fieldname-in-fax-editview"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71457.json b/data/2025/CVE-2025-71457.json index cb99dacc39..f52df27000 100644 --- a/data/2025/CVE-2025-71457.json +++ b/data/2025/CVE-2025-71457.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.1","status":"affected","version":"25.02","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication."},{"lang":"es","value":"vtenext 25.02 anterior a la versión 25.02.1 contiene una vulnerabilidad de omisión de autenticación que permite a atacantes no autenticados cambiar la contraseña de cualquier cuenta a través de hub/rpwd.php sin verificación de token. Los atacantes que conocen un user_name válido pueden enviar action=change_password a RecoverPwd::displayChangePwd() e iniciar sesión como administradores que carecen de autenticación de dos factores."}],"id":"CVE-2025-71457","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71457","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:00.929154Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.340","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.1","status":"affected","version":"25.02","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send action=change_password to RecoverPwd::displayChangePwd() and log in as administrators lacking two-factor authentication."},{"lang":"es","value":"vtenext 25.02 anterior a la versión 25.02.1 contiene una vulnerabilidad de omisión de autenticación que permite a atacantes no autenticados cambiar la contraseña de cualquier cuenta a través de hub/rpwd.php sin verificación de token. Los atacantes que conocen un user_name válido pueden enviar action=change_password a RecoverPwd::displayChangePwd() e iniciar sesión como administradores que carecen de autenticación de dos factores."}],"id":"CVE-2025-71457","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71457","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:00.929154Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:40.340","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25021-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-25.02-before-25.02.1-unverified-password-change-via-hub-rpwd-php"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-620"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71458.json b/data/2025/CVE-2025-71458.json index c0eac46149..1c2515a92b 100644 --- a/data/2025/CVE-2025-71458.json +++ b/data/2025/CVE-2025-71458.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"fts-monitoring","repo":"https://github.com/cern-fts/fts-monitoring","vendor":"cern-fts","versions":[{"lessThan":"3.13.3","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.1","status":"affected","version":"3.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets."},{"lang":"es","value":"FTS3 Web Monitoring (fts-monitoring) versiones 3.12.0 hasta la 3.13.2 incluida y 3.14.0 contienen una vulnerabilidad de inyección SQL no autenticada en el endpoint /linkinfo gestionado por get_linkinfo. Atacantes remotos pueden inyectar SQL a través de los parámetros de consulta source_se y dest_se para realizar una inyección a ciegas y leer credenciales de almacenamiento en la nube almacenadas y secretos de cliente del proveedor de tokens."}],"id":"CVE-2025-71458","lastModified":"2026-11-09T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:56.290509Z","version":"2.0.3"}}]},"published":"2026-11-06T01:17:47.737","references":[{"source":"disclosure@vulncheck.com","url":"https://advisories.egi.eu/Advisory-EGI-SVG-2025-09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"fts-monitoring","repo":"https://github.com/cern-fts/fts-monitoring","vendor":"cern-fts","versions":[{"lessThan":"3.13.3","status":"affected","version":"3.12.0","versionType":"semver"},{"lessThan":"3.14.1","status":"affected","version":"3.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by get_linkinfo. Remote attackers can inject SQL through the source_se and dest_se query parameters to perform blind injection and read stored cloud storage credentials and token provider client secrets."},{"lang":"es","value":"FTS3 Web Monitoring (fts-monitoring) versiones 3.12.0 hasta la 3.13.2 incluida y 3.14.0 contienen una vulnerabilidad de inyección SQL no autenticada en el endpoint /linkinfo gestionado por get_linkinfo. Atacantes remotos pueden inyectar SQL a través de los parámetros de consulta source_se y dest_se para realizar una inyección a ciegas y leer credenciales de almacenamiento en la nube almacenadas y secretos de cliente del proveedor de tokens."}],"id":"CVE-2025-71458","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71458","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:56.290509Z","version":"2.0.3"}}]},"published":"2026-11-06T01:17:47.737","references":[{"source":"disclosure@vulncheck.com","url":"https://advisories.egi.eu/Advisory-EGI-SVG-2025-09"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/blob/v3.14.0/src/apps/ftsmon/views/linkinfo.py#L27-L60"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/96241f6e9911195aae8e9e07bce511da4e81fc08"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/commit/e993c27d60a150c67cc2b415ddb272b5d3f05596"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.13.3"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cern-fts/fts-monitoring/releases/tag/v3.14.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/fts3-web-monitoring-3.12.0-through-3.13.2-and-3.14.0-sql-injection-via-linkinfo"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0169.json b/data/2026/CVE-2026-0169.json index 099172c312..3c8785c8aa 100644 --- a/data/2026/CVE-2026-0169.json +++ b/data/2026/CVE-2026-0169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0169","lastModified":"2026-11-10T21:46:32.010","metrics":{},"published":"2026-11-10T20:17:20.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Android","vendor":"Google","versions":[{"status":"affected","version":"Android kernel"}]}],"source":"dsap-vuln-management@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."}],"id":"CVE-2026-0169","lastModified":"2026-11-12T21:17:17.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:38:03.568064Z","version":"2.0.3"}}]},"published":"2026-11-10T20:17:20.403","references":[{"source":"dsap-vuln-management@google.com","url":"https://source.android.com/docs/security/bulletin/pixel/2026/2026-11-01"}],"sourceIdentifier":"dsap-vuln-management@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-489"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0455.json b/data/2026/CVE-2026-0455.json index 8b9ef7be34..6d999d087f 100644 --- a/data/2026/CVE-2026-0455.json +++ b/data/2026/CVE-2026-0455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Versal™ AI Edge Series Gen 2 Adaptive SoCs","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space."}],"id":"CVE-2026-0455","lastModified":"2026-11-12T20:18:14.237","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.237","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Versal™ AI Edge Series Gen 2 Adaptive SoCs","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"Versal™ Prime Series Gen 2 Adaptive SoCs (2VM3358, 2VM3558, and 2VM3858 only)","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]},{"defaultStatus":"affected","product":"VivadoTM Advanced Configuration Editor for Versal™ AI Edge Series Gen 2","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does not block unauthorized access as expected. This allows processors in the SoC with any IPI channel access the ability to both read and write to the entire IPI buffer register space as well as the IPI no-buffer register control space."}],"id":"CVE-2026-0455","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.237","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8027.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1220"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-0460.json b/data/2026/CVE-2026-0460.json index 94d60c427c..c5994735c1 100644 --- a/data/2026/CVE-2026-0460.json +++ b/data/2026/CVE-2026-0460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Bootgen","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity."}],"id":"CVE-2026-0460","lastModified":"2026-11-12T20:18:14.440","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.440","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Bootgen","vendor":"AMD","versions":[{"status":"unaffected","version":"2026.1"}]}],"source":"psirt@amd.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity."}],"id":"CVE-2026-0460","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@amd.com","type":"Secondary"}]},"published":"2026-11-12T20:18:14.440","references":[{"source":"psirt@amd.com","url":"https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-8025.html"}],"sourceIdentifier":"psirt@amd.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@amd.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100290.json b/data/2026/CVE-2026-100290.json index 820c6a2ed3..ba1984de2b 100644 --- a/data/2026/CVE-2026-100290.json +++ b/data/2026/CVE-2026-100290.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.3","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-100290","lastModified":"2026-11-11T16:17:24.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.667","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=31935"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34991"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.3","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-100290","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.667","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=31935"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34991"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-100395.json b/data/2026/CVE-2026-100395.json index ab7e4b2208..26c6df0f2e 100644 --- a/data/2026/CVE-2026-100395.json +++ b/data/2026/CVE-2026-100395.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"lxc","vendor":"lxc","versions":[{"status":"affected","version":"<= 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The affected surfaces are lxc-copy and liblxc's public lxc_container::clone() API. The privileged cloning process must run as root. The source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component. The clone operation preserves the symlink before updating the hostname. The vulnerable write truncates and overwrites an existing file outside the destination rootfs. When root clones an untrusted container without LXC_CLONE_KEEPNAME, the copied symlink can resolve outside the destination rootfs and cause the privileged process to overwrite an existing host file with the destination container name. Unprivileged use and managers with independent cloning implementations are not affected. LXC_CLONE_KEEPNAME avoids the hostname update and therefore the affected write."}],"id":"CVE-2026-100395","lastModified":"2026-11-09T18:17:18.243","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:36:00.553409Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:41.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/security/advisories/GHSA-r23j-58gg-pjjc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"lxc","vendor":"lxc","versions":[{"status":"affected","version":"<= 7.0.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname in a copied container root filesystem. The affected surfaces are lxc-copy and liblxc's public lxc_container::clone() API. The privileged cloning process must run as root. The source rootfs must be attacker-controlled or less trusted. A symlink can be placed at etc/hostname or in an intermediate component. The clone operation preserves the symlink before updating the hostname. The vulnerable write truncates and overwrites an existing file outside the destination rootfs. When root clones an untrusted container without LXC_CLONE_KEEPNAME, the copied symlink can resolve outside the destination rootfs and cause the privileged process to overwrite an existing host file with the destination container name. Unprivileged use and managers with independent cloning implementations are not affected. LXC_CLONE_KEEPNAME avoids the hostname update and therefore the affected write."}],"id":"CVE-2026-100395","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-100395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:36:00.553409Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:41.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/6424a91a55efc54edc25ca46e9165bd9f35b50b7"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/commit/fa12709a79c2b63b3918297d7505108fcc840eb6"},{"source":"security-advisories@github.com","url":"https://github.com/lxc/lxc/security/advisories/GHSA-r23j-58gg-pjjc"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102280.json b/data/2026/CVE-2026-102280.json index ffb1d50989..883018fec0 100644 --- a/data/2026/CVE-2026-102280.json +++ b/data/2026/CVE-2026-102280.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Sandboxie","vendor":"sandboxie-plus","versions":[{"status":"affected","version":"< 1.18.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6."}],"id":"CVE-2026-102280","lastModified":"2026-11-05T21:18:34.357","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102280","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:49:08.407707Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:42.873","references":[{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/commit/4e121cc4dacdc31973adcb81581b0414d48c26fc"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.6"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Sandboxie","vendor":"sandboxie-plus","versions":[{"status":"affected","version":"< 1.18.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primitive changes file attributes, timestamps, writeability, or 8.3 short names; a short-name redirection can additionally contribute to SYSTEM code execution when a privileged process resolves an attacker-controlled short-name path in a location SbieSvc can open. This vulnerability is fixed in 1.18.6."}],"id":"CVE-2026-102280","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102280","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:49:08.407707Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:42.873","references":[{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/commit/4e121cc4dacdc31973adcb81581b0414d48c26fc"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.18.6"},{"source":"security-advisories@github.com","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-vhjw-4xvf-c74w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-390"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-668"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102289.json b/data/2026/CVE-2026-102289.json index 26589e282a..2a6d85b717 100644 --- a/data/2026/CVE-2026-102289.json +++ b/data/2026/CVE-2026-102289.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."}],"id":"CVE-2026-102289","lastModified":"2026-11-09T22:18:21.590","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.590","references":[{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2213"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2215"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"zizmor","vendor":"zizmorcore","versions":[{"status":"affected","version":"= 1.27.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0."}],"id":"CVE-2026-102289","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.590","references":[{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/0731e01706af273be860d3d221e4d122e6741b6f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/commit/724d0e86f4c073c3dc64507fb6c39bc20e46a48f"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2213"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/pull/2215"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/releases/tag/v1.28.0"},{"source":"security-advisories@github.com","url":"https://github.com/zizmorcore/zizmor/security/advisories/GHSA-f42p-wjw5-97qh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-532"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-102344.json b/data/2026/CVE-2026-102344.json index 03cf0bf6b9..7650a2fbb8 100644 --- a/data/2026/CVE-2026-102344.json +++ b/data/2026/CVE-2026-102344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"lavish-axi","vendor":"kunchenguid","versions":[{"status":"affected","version":"< 0.1.43"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43."}],"id":"CVE-2026-102344","lastModified":"2026-11-09T14:17:05.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102344","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:24:08.716882Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.323","references":[{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"lavish-axi","vendor":"kunchenguid","versions":[{"status":"affected","version":"< 0.1.43"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43."}],"id":"CVE-2026-102344","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102344","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T13:24:08.716882Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.323","references":[{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/commit/f016972251556a83cd4712cf081a475cfcf3646a"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/releases/tag/lavish-axi-v0.1.43"},{"source":"security-advisories@github.com","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/kunchenguid/lavish-axi/security/advisories/GHSA-fwx2-qmmq-qvx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102356.json b/data/2026/CVE-2026-102356.json index 2904e815c7..b335338b27 100644 --- a/data/2026/CVE-2026-102356.json +++ b/data/2026/CVE-2026-102356.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":">= 0.26.0, < 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102356","lastModified":"2026-11-09T23:17:10.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:34:57.248729Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:36.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":">= 0.26.0, < 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. From 0.26.0 until 0.31.2, the optional Mermaid companion's mermaid/src/worker.js renders attacker-controlled flowchart image nodes in headless Chromium without a network request policy, even when KROKI_SAFE_MODE is set to secure. An actor who can submit Mermaid source and satisfy any authentication or authorization configured by the deployment can cause the companion to issue HTTP or HTTPS GET requests when requesting PNG output. Exploitation requires the Mermaid companion, PNG rendering through its headless Chromium process, a diagram-submission path available to the actor, and network reachability from the companion to the target. The demonstrated impact is limited to blind request reachability and possible state-changing GET endpoints; response exfiltration, cloud metadata access, port scanning, and access beyond the companion's network reachability are not established. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102356","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102356","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:34:57.248729Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:36.717","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/428ea380bc7db9da5c7947f908851c8461d51f82"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-px99-rjv4-49g8"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102359.json b/data/2026/CVE-2026-102359.json index 66f98ff134..5e28e50e7a 100644 --- a/data/2026/CVE-2026-102359.json +++ b/data/2026/CVE-2026-102359.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":"< 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102359","lastModified":"2026-11-11T05:19:15.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:13:29.742291Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.110","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"kroki","vendor":"yuzutech","versions":[{"status":"affected","version":"< 0.31.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki creates diagrams from textual descriptions. Prior to 0.31.2, the TikZ backend's tikz/tikz2svg guard used when KROKI_SAFE_MODE is enabled blocks only \\verbatiminput while allowing native TeX file-read primitives including \\openin, \\read, \\input, and \\include. TeX Live's permissive openin_any setting remains active, so an unauthenticated actor can submit crafted LaTeX to POST /tikz/svg or the generic diagram API and cause the renderer to read any file accessible to the Kroki container user. The file contents are rendered into the returned SVG, which may disclose mounted secrets, configuration data, credentials, private keys, or process environment data. The -no-shell-escape option prevents shell execution but does not restrict these native file operations. This issue is fixed in version 0.31.2."}],"id":"CVE-2026-102359","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:13:29.742291Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.110","references":[{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/commit/9108ab5b429b9dc82b76432ccf40d4d7eeba1b30"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.31.2"},{"source":"security-advisories@github.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-r54f-fq6c-53vw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102530.json b/data/2026/CVE-2026-102530.json index bb852e52af..0ace8ba5ed 100644 --- a/data/2026/CVE-2026-102530.json +++ b/data/2026/CVE-2026-102530.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1."}],"id":"CVE-2026-102530","lastModified":"2026-11-09T23:17:10.373","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:10.314722Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"jupyterlab-desktop","vendor":"jupyterlab","versions":[{"status":"affected","version":"< 4.6.2-1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1."}],"id":"CVE-2026-102530","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:10.314722Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.510","references":[{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"},{"source":"security-advisories@github.com","url":"https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-116"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102610.json b/data/2026/CVE-2026-102610.json index b65cb149fe..b2fa235f94 100644 --- a/data/2026/CVE-2026-102610.json +++ b/data/2026/CVE-2026-102610.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"fast-agent","vendor":"evalstate","versions":[{"status":"affected","version":"< 0.7.21"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21."}],"id":"CVE-2026-102610","lastModified":"2026-11-09T23:17:10.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:12.920835Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.677","references":[{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/pull/828"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"fast-agent","vendor":"evalstate","versions":[{"status":"affected","version":"< 0.7.21"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21."}],"id":"CVE-2026-102610","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.5,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:12.920835Z","version":"2.0.3"}}]},"published":"2026-11-06T21:17:05.677","references":[{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/pull/828"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21"},{"source":"security-advisories@github.com","url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102618.json b/data/2026/CVE-2026-102618.json index 6f78120505..77642cdbeb 100644 --- a/data/2026/CVE-2026-102618.json +++ b/data/2026/CVE-2026-102618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"],"product":"i","vendor":"IBM","versions":[{"status":"affected","version":"7.6"},{"status":"affected","version":"7.5"},{"status":"affected","version":"7.4"},{"status":"affected","version":"7.3"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable."}],"id":"CVE-2026-102618","lastModified":"2026-11-08T16:16:36.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.6,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T16:16:36.283","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295136"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"],"product":"i","vendor":"IBM","versions":[{"status":"affected","version":"7.6"},{"status":"affected","version":"7.5"},{"status":"affected","version":"7.4"},{"status":"affected","version":"7.3"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable."}],"id":"CVE-2026-102618","lastModified":"2026-11-12T21:17:17.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":3.6,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.0,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:10:31.278004Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:36.283","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295136"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102643.json b/data/2026/CVE-2026-102643.json index 72a10a8378..4ead8987d7 100644 --- a/data/2026/CVE-2026-102643.json +++ b/data/2026/CVE-2026-102643.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"asyncssh","vendor":"ronf","versions":[{"status":"affected","version":"< 2.24.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1."}],"id":"CVE-2026-102643","lastModified":"2026-11-09T22:18:21.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-50"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"asyncssh","vendor":"ronf","versions":[{"status":"affected","version":"< 2.24.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1."}],"id":"CVE-2026-102643","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-09T22:18:21.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1"},{"source":"security-advisories@github.com","url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-50"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-102650.json b/data/2026/CVE-2026-102650.json index 0f3f78cfd9..183e6fcb7a 100644 --- a/data/2026/CVE-2026-102650.json +++ b/data/2026/CVE-2026-102650.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"content","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2."}],"id":"CVE-2026-102650","lastModified":"2026-11-10T20:17:22.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102650","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:00:27.289455Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.333","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/pull/3819"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/releases/tag/v3.15.2"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"content","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 3.15.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2."}],"id":"CVE-2026-102650","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102650","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:00:27.289455Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:37.333","references":[{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/pull/3819"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/releases/tag/v3.15.2"},{"source":"security-advisories@github.com","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102803.json b/data/2026/CVE-2026-102803.json index 7d5d471a9e..7dec7f4023 100644 --- a/data/2026/CVE-2026-102803.json +++ b/data/2026/CVE-2026-102803.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"J2Store extension for Joomla","vendor":"j2commerce.com","versions":[{"status":"affected","version":"6.0.0-6.6.5"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more than one order. By starting several checkout sessions and carrying each to the confirm step before submitting any of them, every order independently saw the voucher's full balance or the coupon's unused slot, because the balance/usage calculations and the final placement check both only looked at orders that had already left the \"New\" state."}],"id":"CVE-2026-102803","lastModified":"2026-11-12T22:17:34.157","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:35:28.982773Z","version":"2.0.3"}}]},"published":"2026-11-10T17:17:18.350","references":[{"source":"security@joomla.org","url":"https://www.j2commerce.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102894.json b/data/2026/CVE-2026-102894.json index 41df1c4c99..1b7034003a 100644 --- a/data/2026/CVE-2026-102894.json +++ b/data/2026/CVE-2026-102894.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 0.7.1, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-102894","lastModified":"2026-11-06T12:17:15.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102894","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:42.523586Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5753"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5923"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 0.7.1, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-102894","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102894","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:42.523586Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.440","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5753"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5923"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-347"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102927.json b/data/2026/CVE-2026-102927.json index 4120586830..8d8b8a35e0 100644 --- a/data/2026/CVE-2026-102927.json +++ b/data/2026/CVE-2026-102927.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"hedgedoc","vendor":"hedgedoc","versions":[{"status":"affected","version":"< 1.11.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1."}],"id":"CVE-2026-102927","lastModified":"2026-11-09T18:17:18.387","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:28:34.545953Z","version":"2.0.3"}}]},"published":"2026-11-05T18:16:59.140","references":[{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"hedgedoc","vendor":"hedgedoc","versions":[{"status":"affected","version":"< 1.11.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.1, the WebSocket permission handler allows a note owner to store strings outside the supported freely, editable, limited, locked, protected, and private permission values. The viewing and editing checks handle only known values and can otherwise fall through to permissive behavior, making a note readable or writable more broadly than intended. SQLite deployments can persist the invalid value because the database column does not strictly enforce the set, while MySQL and PostgreSQL reject the database update but can leave the in-memory note state inconsistent for connected users until reload or cache eviction. Exploitation requires the note owner to intentionally submit an invalid permission value, and the owner could already choose a legitimate permissive setting, which limits the practical security impact. This issue is fixed in version 1.11.1."}],"id":"CVE-2026-102927","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102927","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:28:34.545953Z","version":"2.0.3"}}]},"published":"2026-11-05T18:16:59.140","references":[{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/commit/0dda149c7f528a7e98a34a8459b7afb23c90a05b"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1"},{"source":"security-advisories@github.com","url":"https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-93w7-49m2-cqwg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-102943.json b/data/2026/CVE-2026-102943.json index cf6734f88f..55bedb9082 100644 --- a/data/2026/CVE-2026-102943.json +++ b/data/2026/CVE-2026-102943.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"dagu","vendor":"dagucloud","versions":[{"status":"affected","version":"< 2.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0."}],"id":"CVE-2026-102943","lastModified":"2026-11-06T18:17:37.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102943","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:42:43.623220Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:49.180","references":[{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/commit/c15c5406bb7b9551f94ab276705f9fd1cebbf2d2"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/pull/2424"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/releases/tag/v2.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"dagu","vendor":"dagucloud","versions":[{"status":"affected","version":"< 2.11.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0."}],"id":"CVE-2026-102943","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-102943","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:42:43.623220Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:49.180","references":[{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/commit/c15c5406bb7b9551f94ab276705f9fd1cebbf2d2"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/pull/2424"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/releases/tag/v2.11.0"},{"source":"security-advisories@github.com","url":"https://github.com/dagucloud/dagu/security/advisories/GHSA-5m6c-38r8-5w76"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103002.json b/data/2026/CVE-2026-103002.json index 8f2061f7a9..66b6d6e574 100644 --- a/data/2026/CVE-2026-103002.json +++ b/data/2026/CVE-2026-103002.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 2.2.0, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-103002","lastModified":"2026-11-06T12:17:15.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:43.686904Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5911"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5936"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"gpustack","vendor":"gpustack","versions":[{"status":"affected","version":">= 2.2.0, < 2.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}],"id":"CVE-2026-103002","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:43.686904Z","version":"2.0.3"}}]},"published":"2026-11-04T22:17:44.783","references":[{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5911"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/pull/5936"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103022.json b/data/2026/CVE-2026-103022.json index 4581bdfde8..bfba99a0e0 100644 --- a/data/2026/CVE-2026-103022.json +++ b/data/2026/CVE-2026-103022.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"urwid","vendor":"urwid","versions":[{"status":"affected","version":"< 4.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7."}],"id":"CVE-2026-103022","lastModified":"2026-11-11T05:19:15.583","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:39:06.834605Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:49.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/pull/1201"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/releases/tag/4.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-775"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"urwid","vendor":"urwid","versions":[{"status":"affected","version":"< 4.0.7"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7."}],"id":"CVE-2026-103022","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:39:06.834605Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:49.920","references":[{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/pull/1201"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/releases/tag/4.0.7"},{"source":"security-advisories@github.com","url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-116"},{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-775"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103932.json b/data/2026/CVE-2026-103932.json index fa1e70f913..20c5d75907 100644 --- a/data/2026/CVE-2026-103932.json +++ b/data/2026/CVE-2026-103932.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.5, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-103932","lastModified":"2026-11-09T18:17:18.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103932","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:14:11.605958Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:24.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-253"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.5, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors into an ordinary no-match result instead of propagating a non-OK RegexResult. When attacker-controlled input exhausts SecPcreMatchLimit, rules that rely on MSC_PCRE_LIMITS_EXCEEDED or its TX compatibility indicator do not run, so a request that should be rejected can pass through the WAF. The issue affects PCRE2 deployments that use @rxGlobal with a limit-exhaustible expression and a compensating rule; it is not a universal WAF bypass. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-103932","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103932","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:14:11.605958Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:24.900","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/d92bdc3b2183824ba3c582154b7385ee8349ea7e"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5m93-4h75-3p2w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-253"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103963.json b/data/2026/CVE-2026-103963.json index 206aed02fc..df9039c8d1 100644 --- a/data/2026/CVE-2026-103963.json +++ b/data/2026/CVE-2026-103963.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS)."}],"id":"CVE-2026-103963","lastModified":"2026-11-04T22:17:44.947","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:03:18.185158Z","version":"2.0.3"}}]},"published":"2026-10-30T05:16:57.237","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465656"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.68.3-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:2.68.3-3.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"glib-networking","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS)."}],"id":"CVE-2026-103963","lastModified":"2026-11-12T22:17:34.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-103963","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T02:03:18.185158Z","version":"2.0.3"}}]},"published":"2026-10-30T05:16:57.237","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99695"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-103963"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2465656"},{"source":"secalert@redhat.com","url":"https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/288"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-103980.json b/data/2026/CVE-2026-103980.json index ad185aa18b..d72ce44bee 100644 --- a/data/2026/CVE-2026-103980.json +++ b/data/2026/CVE-2026-103980.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."}],"id":"CVE-2026-103980","lastModified":"2026-11-11T21:16:42.083","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:42.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"ideon","vendor":"3xpyth0n","versions":[{"status":"affected","version":"< 0.9.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6."}],"id":"CVE-2026-103980","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}]},"published":"2026-11-11T21:16:42.083","references":[{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6"},{"source":"security-advisories@github.com","url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security-advisories@github.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-104060.json b/data/2026/CVE-2026-104060.json index 4611ae1635..1ace9e446b 100644 --- a/data/2026/CVE-2026-104060.json +++ b/data/2026/CVE-2026-104060.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Worklenz/worklenz","product":"worklenz","repo":"https://github.com/Worklenz/worklenz","vendor":"Worklenz","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes."}],"id":"CVE-2026-104060","lastModified":"2026-11-10T20:17:23.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T20:17:23.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Worklenz/worklenz","product":"worklenz","repo":"https://github.com/Worklenz/worklenz","vendor":"Worklenz","versions":[{"lessThan":"3.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted values to POST /api/v1/reporting/members/all or GET /api/v1/reporting/members/export, which are interpolated unparameterized into IN clauses in getTeamMemberInsightData, and use time-based blind techniques to extract data across tenants, including user password hashes."}],"id":"CVE-2026-104060","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-10T20:17:23.897","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/commit/f58c7dbcc68fcda31a5cd4ce68d02af7ea8c37e1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/pull/624"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Worklenz/worklenz/releases/tag/v3.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/worklenz-sql-injection-via-reporting-members-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-104254.json b/data/2026/CVE-2026-104254.json index 3268374a89..f1b36b0933 100644 --- a/data/2026/CVE-2026-104254.json +++ b/data/2026/CVE-2026-104254.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"liboqs","vendor":"open-quantum-safe","versions":[{"status":"affected","version":">= 0.11.0, <= 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0."}],"id":"CVE-2026-104254","lastModified":"2026-11-09T23:17:11.247","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104254","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:48.736338Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.107","references":[{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/commit/df3eb80fe68d2e5db0ecf5d503082cd5699e0859"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/pull/2507"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-wh5q-mpc8-67wf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"liboqs","vendor":"open-quantum-safe","versions":[{"status":"affected","version":">= 0.11.0, <= 0.16.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. From 0.11.0 through 0.16.0, builds configured with OQS_ENABLE_SIG_STFL_LMS=ON can read beyond a caller-supplied signature buffer when an untrusted truncated LMS or HSS-LMS signature reaches OQS_SIG_STFL_verify or OQS_SIG_STFL_alg_lms_verify. In hss_validate_signature_init() in src/sig_stfl/lms/external/hss_verify_inc.c, consumed-length checks do not ensure that the bottom-level q and C fields remain available, allowing up to 32 bytes to be read past the buffer. In version 0.16.0, is_hss_public_key() also reads at offset 8 after only a four-byte length check, allowing an over-read of up to eight bytes. No valid signature is required, but the public key must be syntactically plausible. The read data is consumed only by an internal hash and is not exposed, so the supported impact is a possible verifier crash and denial of service, not memory disclosure or acceptance of an invalid signature. This issue is scheduled to be fixed in version 0.17.0."}],"id":"CVE-2026-104254","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104254","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:36:48.736338Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.107","references":[{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/commit/df3eb80fe68d2e5db0ecf5d503082cd5699e0859"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/pull/2507"},{"source":"security-advisories@github.com","url":"https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-wh5q-mpc8-67wf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104259.json b/data/2026/CVE-2026-104259.json index 29bb54cee0..4a054e51a1 100644 --- a/data/2026/CVE-2026-104259.json +++ b/data/2026/CVE-2026-104259.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-104259","lastModified":"2026-11-10T19:17:41.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:32.704323Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:22.160","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/264f348ae1823cb71cead3650b74c165678a1d46"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/49a65f471d3130b91f7fff9bfac9fe8dd9b97c44"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrch-pjfr-9g47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":"< 2.9.15"},{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17."}],"id":"CVE-2026-104259","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104259","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:18:32.704323Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:22.160","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/264f348ae1823cb71cead3650b74c165678a1d46"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/49a65f471d3130b91f7fff9bfac9fe8dd9b97c44"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-qrch-pjfr-9g47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-670"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104267.json b/data/2026/CVE-2026-104267.json index b7cbd1f4d9..58f767b5da 100644 --- a/data/2026/CVE-2026-104267.json +++ b/data/2026/CVE-2026-104267.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"botan","vendor":"randombit","versions":[{"status":"affected","version":">= 2.7.0, < 3.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0."}],"id":"CVE-2026-104267","lastModified":"2026-11-11T05:19:15.803","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:38:20.231461Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.303","references":[{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/commit/459acdeba242dacc11ad8225e7d3e28203ce4f78"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/pull/5629"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/security/advisories/GHSA-36rp-hhp4-wh83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"botan","vendor":"randombit","versions":[{"status":"affected","version":">= 2.7.0, < 3.13.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Botan is a C++ cryptography library. From 2.7.0 until 3.13.0, Botan's Scrypt implementation on 32-bit platforms computes required memory with unchecked multiplication, allowing attacker-controlled Scrypt parameters to wrap the allocation size and create a buffer smaller than the algorithm subsequently writes. The issue affects systems that enable Scrypt and accept arbitrary parameters from a hostile source, including applications that decrypt attacker-supplied encrypted private keys. A triggering parameter set can cause approximately four gigabytes of Scrypt output to be written past the allocated heap buffer, immediately crashing the process and causing denial of service. Arbitrary code execution is not demonstrated and appears difficult, but cannot be excluded from the overwrite primitive. This issue is fixed in version 3.13.0."}],"id":"CVE-2026-104267","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104267","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:38:20.231461Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.303","references":[{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/commit/459acdeba242dacc11ad8225e7d3e28203ce4f78"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/pull/5629"},{"source":"security-advisories@github.com","url":"https://github.com/randombit/botan/security/advisories/GHSA-36rp-hhp4-wh83"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104269.json b/data/2026/CVE-2026-104269.json index 9c3506b87e..2fcff149db 100644 --- a/data/2026/CVE-2026-104269.json +++ b/data/2026/CVE-2026-104269.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-104269","lastModified":"2026-11-09T18:17:19.303","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104269","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:15:25.361996Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:29.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ModSecurity","vendor":"owasp-modsecurity","versions":[{"status":"affected","version":">= 3.0.0, < 3.0.17"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by common Go, Python, Node.js, and Java application parsers. A Content-Disposition header can provide a benign filename parameter for ModSecurity and a different encoded filename* value that the backend prefers, causing MULTIPART_FILENAME rules and the application to make security decisions on different names. Applications that use the backend-selected name for storage, extension checks, or content-type inference can therefore receive a filename that bypassed WAF inspection. PHP's native multipart parser is not affected by this discrepancy. This issue is fixed in version 3.0.17."}],"id":"CVE-2026-104269","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104269","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:15:25.361996Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:29.377","references":[{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/463db0c840fa27bfba095b0406a63004a12884b0"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/commit/c6bd53d2dd96766b3afdc35d9929ebb20925d13d"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.15"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.17"},{"source":"security-advisories@github.com","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-5pww-8rfg-9crf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-436"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-104608.json b/data/2026/CVE-2026-104608.json index 180e1c519b..019115d5c2 100644 --- a/data/2026/CVE-2026-104608.json +++ b/data/2026/CVE-2026-104608.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-104608","lastModified":"2026-11-06T19:17:06.287","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:10:23.666531Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:24.420","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-1265"}],"source":"product-cna@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with an account and SSH access to the instance could leverage this use-after-free into a controlled write and run arbitrary commands as babeld, including disclosure of its environment secrets. Exploitation required per-build memory offsets; failed attempts crashed babeld. This affected all releases prior to 3.23 and was fixed in 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-104608","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-104608","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:10:23.666531Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:24.420","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-1265"}],"source":"product-cna@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105459.json b/data/2026/CVE-2026-105459.json index 2b896059f6..bbb02af7d8 100644 --- a/data/2026/CVE-2026-105459.json +++ b/data/2026/CVE-2026-105459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation."}],"id":"CVE-2026-105459","lastModified":"2026-11-10T17:01:09.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-07T05:18:00.013","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:api_connect:12.1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:12.1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:api_connect:10.0.8.12:*:*:*:*:*:*:*"],"product":"API Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"12.1.1.2","status":"affected","version":"12.1.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.8.12","status":"affected","version":"10.0.8.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"E68DE342-3A11-4B37-BFBA-520725CA5AAC","versionEndExcluding":"10.0.8.13","versionStartIncluding":"10.0.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:api_connect:*:*:*:*:*:*:*:*","matchCriteriaId":"4E7D2F8B-1E9C-4120-9990-5F5B5EE5C3AC","versionEndExcluding":"12.1.1.3","versionStartIncluding":"12.1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation."}],"id":"CVE-2026-105459","lastModified":"2026-11-12T21:17:17.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:11:04.981852Z","version":"2.0.3"}}]},"published":"2026-11-07T05:18:00.013","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295635"},{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295637"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105612.json b/data/2026/CVE-2026-105612.json index faffa08c26..f9c242b7a0 100644 --- a/data/2026/CVE-2026-105612.json +++ b/data/2026/CVE-2026-105612.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions"}],"id":"CVE-2026-105612","lastModified":"2026-11-05T17:17:33.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:00:32.266528Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:02.850","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/702"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions"}],"id":"CVE-2026-105612","lastModified":"2026-11-12T21:03:11.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:00:32.266528Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:02.850","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/702"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105618.json b/data/2026/CVE-2026-105618.json index 7e6ce78d6f..363624285d 100644 --- a/data/2026/CVE-2026-105618.json +++ b/data/2026/CVE-2026-105618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105618","lastModified":"2026-11-05T17:17:34.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:57:09.390532Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.633","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/696"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105618","lastModified":"2026-11-12T21:00:39.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:57:09.390532Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.633","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/696"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105619.json b/data/2026/CVE-2026-105619.json index 2960779703..38be5e21ff 100644 --- a/data/2026/CVE-2026-105619.json +++ b/data/2026/CVE-2026-105619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105619","lastModified":"2026-11-05T17:17:34.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:51.078427Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.780","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/697"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105619","lastModified":"2026-11-12T20:55:18.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:51.078427Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:03.780","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/697"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-105620.json b/data/2026/CVE-2026-105620.json index 3888924ed0..d8d69da891 100644 --- a/data/2026/CVE-2026-105620.json +++ b/data/2026/CVE-2026-105620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105620","lastModified":"2026-11-05T17:17:34.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:25.420575Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:04.003","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/698"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-105620","lastModified":"2026-11-12T20:54:09.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-105620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:52:25.420575Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:04.003","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/698"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106018.json b/data/2026/CVE-2026-106018.json new file mode 100644 index 0000000000..376b24727b --- /dev/null +++ b/data/2026/CVE-2026-106018.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EasyIO FW","vendor":"Johnson Controls","versions":[{"lessThanOrEqual":"3.0b25","status":"affected","version":"0","versionType":"custom"}]}],"source":"productsecurity@jci.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.\n\nThis issue affects EasyIO FW: through 3.0b25."}],"id":"CVE-2026-106018","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productsecurity@jci.com","type":"Secondary"}]},"published":"2026-11-12T21:17:17.923","references":[{"source":"productsecurity@jci.com","url":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"}],"sourceIdentifier":"productsecurity@jci.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"productsecurity@jci.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106554.json b/data/2026/CVE-2026-106554.json index 19a51361a3..5fca52189d 100644 --- a/data/2026/CVE-2026-106554.json +++ b/data/2026/CVE-2026-106554.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.fasterxml.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"2.18.12","status":"affected","version":"2.15.0","versionType":"maven"},{"status":"unaffected","version":"2.18.12","versionType":"maven"},{"lessThan":"2.21.8","status":"affected","version":"2.19.0","versionType":"maven"},{"status":"unaffected","version":"2.21.8","versionType":"maven"},{"lessThan":"2.22.4","status":"affected","version":"2.22.0","versionType":"maven"},{"status":"unaffected","version":"2.22.4","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"tools.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"3.1.8","status":"affected","version":"3.0.0","versionType":"maven"},{"status":"unaffected","version":"3.1.8","versionType":"maven"},{"lessThan":"3.2.4","status":"affected","version":"3.2.0","versionType":"maven"},{"status":"unaffected","version":"3.2.4","versionType":"maven"}]}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"cveTags":[],"descriptions":[{"lang":"en","value":"One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."}],"id":"CVE-2026-106554","lastModified":"2026-11-10T13:18:19.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106554","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:57:21.443264Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:32.640","references":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"}],"sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"com.fasterxml.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"2.18.12","status":"affected","version":"2.15.0","versionType":"maven"},{"status":"unaffected","version":"2.18.12","versionType":"maven"},{"lessThan":"2.21.8","status":"affected","version":"2.19.0","versionType":"maven"},{"status":"unaffected","version":"2.21.8","versionType":"maven"},{"lessThan":"2.22.4","status":"affected","version":"2.22.0","versionType":"maven"},{"status":"unaffected","version":"2.22.4","versionType":"maven"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"tools.jackson.dataformat:jackson-dataformat-cbor","product":"jackson-dataformat-cbor","programFiles":["cbor/src/main/java/.../cbor/CBORParser.java"],"programRoutines":[{"name":"CBORParser (tag handling -> TagList)"}],"repo":"https://github.com/FasterXML/jackson-dataformats-binary","vendor":"FasterXML","versions":[{"lessThan":"3.1.8","status":"affected","version":"3.0.0","versionType":"maven"},{"status":"unaffected","version":"3.1.8","versionType":"maven"},{"lessThan":"3.2.4","status":"affected","version":"3.2.0","versionType":"maven"},{"status":"unaffected","version":"3.2.4","versionType":"maven"}]}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c"}],"cveTags":[],"descriptions":[{"lang":"en","value":"One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."}],"id":"CVE-2026-106554","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106554","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T12:57:21.443264Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:32.640","references":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"}],"sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106713.json b/data/2026/CVE-2026-106713.json index 3ef0f76d78..b0f3da2650 100644 --- a/data/2026/CVE-2026-106713.json +++ b/data/2026/CVE-2026-106713.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component"}],"id":"CVE-2026-106713","lastModified":"2026-11-10T14:17:11.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106713","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:15:16.491153Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.613","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/FreeReels_2.3.11"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the com.dramawave.feature.web.WebPageActivity component"}],"id":"CVE-2026-106713","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106713","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:15:16.491153Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.613","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/FreeReels_2.3.11"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/FreeReels_2.3.11/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106714.json b/data/2026/CVE-2026-106714.json index 231389057f..9b515a10c2 100644 --- a/data/2026/CVE-2026-106714.json +++ b/data/2026/CVE-2026-106714.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/ path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link."}],"id":"CVE-2026-106714","lastModified":"2026-11-10T14:17:11.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106714","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:13:51.371117Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.767","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Chewy for Android version 26.23.0 does not adequately validate the host of a product-details deep link before loading it in a Hybrid WebView. An attacker-controlled page with a /dp/ path can access the injected nma_petmd_bridge JavaScript interface and invoke getPetProfiles, disclosing a signed-in user's pet profile information after the user opens the crafted link."}],"id":"CVE-2026-106714","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106714","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:13:51.371117Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.767","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/Chewy_26.23.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/Chewy_26.23.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106715.json b/data/2026/CVE-2026-106715.json index bb90813eb2..897d2eba98 100644 --- a/data/2026/CVE-2026-106715.json +++ b/data/2026/CVE-2026-106715.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link."}],"id":"CVE-2026-106715","lastModified":"2026-11-10T13:18:19.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106715","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:08:24.721739Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.900","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/NewsBreak_26.21.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NewsBreak for Android version 26.21.0 treats data:text/html; URLs as trusted in its WebView JavaScript bridge origin check. An attacker can supply such a page through the newsbreak://openweb deep link and invoke NBJS.callNative with the getLoginInfo action, disclosing a signed-in user's account information and session token after the user opens the crafted link."}],"id":"CVE-2026-106715","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106715","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:08:24.721739Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:16.900","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/NewsBreak_26.21.0"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/NewsBreak_26.21.0/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-106716.json b/data/2026/CVE-2026-106716.json index bd0e54f311..3c5bbb88fc 100644 --- a/data/2026/CVE-2026-106716.json +++ b/data/2026/CVE-2026-106716.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload."}],"id":"CVE-2026-106716","lastModified":"2026-11-10T13:18:20.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106716","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:02:03.440353Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.033","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/ReelShort_3.8.55"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. After a user opens the crafted link, the page can invoke getUserInfo, getCredentials, and initUser to obtain user metadata and an encrypted credential payload."}],"id":"CVE-2026-106716","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-106716","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T13:02:03.440353Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.033","references":[{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"},{"source":"cve@mitre.org","url":"https://github.com/Siestazzz/myVulnDB/tree/main/Mobile/ReelShort_3.8.55"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/Siestazzz/myVulnDB/blob/main/Mobile/ReelShort_3.8.55/report.en.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-939"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107245.json b/data/2026/CVE-2026-107245.json index 6c836ad6c5..8d2371876a 100644 --- a/data/2026/CVE-2026-107245.json +++ b/data/2026/CVE-2026-107245.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"23.1.2","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."}],"id":"CVE-2026-107245","lastModified":"2026-11-12T14:17:22.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107245","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:27:13.231481Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.740","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"VOS","vendor":"Versa","versions":[{"lessThanOrEqual":"21.2.3","status":"affected","version":"21.1.1","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.2","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.3","versionType":"semver"},{"lessThan":"July 2, 2026","status":"affected","version":"22.1.4","versionType":"semver"},{"lessThan":"23.1.2","status":"affected","version":"23.1.2","versionType":"semver"},{"lessThan":"22.1.2 July-2-2026-Hotfix","status":"unaffected","version":"22.1.2 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.3 July-2-2026-Hotfix","status":"unaffected","version":"22.1.3 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"22.1.4 July-2-2026-Hotfix","status":"unaffected","version":"22.1.4 July-2-2026-Hotfix","versionType":"semver"},{"lessThan":"23.1.2 Aug-3-2026-Hotfix","status":"unaffected","version":"23.1.2 Aug-3-2026-Hotfix","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. \n \n Buffer Overflow Vulnerability Description \n \nWhen a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. \n \nDuring the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. \n \nWhat is impacted? \n \nVOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. \n \nWhat is not impacted? \n \nThe VOS nodes listed above are not vulnerable if they are not accessible from the Internet."}],"id":"CVE-2026-107245","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107245","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:27:13.231481Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.740","references":[{"source":"support@hackerone.com","url":"https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107246.json b/data/2026/CVE-2026-107246.json index e8da87856f..456f82bf99 100644 --- a/data/2026/CVE-2026-107246.json +++ b/data/2026/CVE-2026-107246.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Plesk extension \"Site Import\"","vendor":"WebPros","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root."}],"id":"CVE-2026-107246","lastModified":"2026-11-12T14:17:22.757","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:25:49.064016Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.880","references":[{"source":"support@hackerone.com","url":"https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Plesk extension \"Site Import\"","vendor":"WebPros","versions":[{"lessThan":"1.13.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Plesk extension \"Site Import\" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal. This lets a non-owner subscription user redirect a privileged backend session into a directory they control, resulting in arbitrary code execution as root."}],"id":"CVE-2026-107246","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"support@hackerone.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107246","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T13:25:49.064016Z","version":"2.0.3"}}]},"published":"2026-11-10T01:17:12.880","references":[{"source":"support@hackerone.com","url":"https://support.plesk.com/hc/en-us/articles/44831088501527-Vulnerability-CVE-2026-107246-in-Plesk-s-Site-Import-extension"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107331.json b/data/2026/CVE-2026-107331.json index 732d4fd919..22d9038e23 100644 --- a/data/2026/CVE-2026-107331.json +++ b/data/2026/CVE-2026-107331.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"product":"DataStage on Cloud Pak for Data","vendor":"IBM","versions":[{"status":"affected","version":"5.4.0.0"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability."}],"id":"CVE-2026-107331","lastModified":"2026-11-08T17:16:35.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T17:16:35.550","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294270"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"product":"DataStage on Cloud Pak for Data","vendor":"IBM","versions":[{"status":"affected","version":"5.4.0.0"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability."}],"id":"CVE-2026-107331","lastModified":"2026-11-12T21:17:19.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107331","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:06:01.953926Z","version":"2.0.3"}}]},"published":"2026-11-08T17:16:35.550","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294270"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-36"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107359.json b/data/2026/CVE-2026-107359.json index c26c6a4dc3..ebd8feb3c8 100644 --- a/data/2026/CVE-2026-107359.json +++ b/data/2026/CVE-2026-107359.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WF200 FW","repo":"https://github.com/SiliconLabs/wfx-firmware/","vendor":"Silicon Labs","versions":[{"lessThanOrEqual":"3.17.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@silabs.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault."}],"id":"CVE-2026-107359","lastModified":"2026-11-05T20:17:40.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-security@silabs.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107359","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:42.303262Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:00.370","references":[{"source":"product-security@silabs.com","url":"https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md"}],"sourceIdentifier":"product-security@silabs.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"product-security@silabs.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WF200 FW","repo":"https://github.com/SiliconLabs/wfx-firmware/","vendor":"Silicon Labs","versions":[{"lessThanOrEqual":"3.17.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"product-security@silabs.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault."}],"id":"CVE-2026-107359","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-security@silabs.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107359","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:04:42.303262Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:00.370","references":[{"source":"product-security@silabs.com","url":"https://github.com/SiliconLabsSoftware/docs-security-advisories/blob/main/Advisories/500-599/A-00000593.md"}],"sourceIdentifier":"product-security@silabs.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"product-security@silabs.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107891.json b/data/2026/CVE-2026-107891.json index 54ece28e43..92c94ff6fb 100644 --- a/data/2026/CVE-2026-107891.json +++ b/data/2026/CVE-2026-107891.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"musl","vendor":"musl -libc","versions":[{"lessThan":"1.2.7","status":"affected","version":"0.5.0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}],"id":"CVE-2026-107891","lastModified":"2026-11-09T22:18:22.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:09:44.546721Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:32.150","references":[{"source":"cve@mitre.org","url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"},{"source":"cve@mitre.org","url":"https://musl.libc.org"},{"source":"cve@mitre.org","url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/21/18"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"musl","vendor":"musl -libc","versions":[{"lessThan":"1.2.7","status":"affected","version":"0.5.0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes."}],"id":"CVE-2026-107891","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-107891","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:09:44.546721Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:32.150","references":[{"source":"cve@mitre.org","url":"https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941"},{"source":"cve@mitre.org","url":"https://musl.libc.org"},{"source":"cve@mitre.org","url":"https://www.openwall.com/lists/musl/2026/10/21/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/10/21/18"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108018.json b/data/2026/CVE-2026-108018.json index d8fc4b2630..68bb95d0ba 100644 --- a/data/2026/CVE-2026-108018.json +++ b/data/2026/CVE-2026-108018.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigFix MCM & Mobile","vendor":"HCLSoftware","versions":[{"status":"affected","version":"<= 3.7"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts."}],"id":"CVE-2026-108018","lastModified":"2026-11-10T18:17:18.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"psirt@hcl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:33:57.046825Z","version":"2.0.3"}}]},"published":"2026-11-06T09:16:59.527","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@hcl.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigFix MCM & Mobile","vendor":"HCLSoftware","versions":[{"status":"affected","version":"<= 3.7"}]}],"source":"psirt@hcl.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts."}],"id":"CVE-2026-108018","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"psirt@hcl.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T17:33:57.046825Z","version":"2.0.3"}}]},"published":"2026-11-06T09:16:59.527","references":[{"source":"psirt@hcl.com","url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@hcl.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108262.json b/data/2026/CVE-2026-108262.json index d6c90ca54a..1a7bc6bd4d 100644 --- a/data/2026/CVE-2026-108262.json +++ b/data/2026/CVE-2026-108262.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":">= 1.25.2, < 1.25.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4."}],"id":"CVE-2026-108262","lastModified":"2026-11-11T05:19:17.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:16:29.590639Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:06.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":">= 1.25.2, < 1.25.4"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4."}],"id":"CVE-2026-108262","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108262","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-11T03:16:29.590639Z","version":"2.0.3"}}]},"published":"2026-11-06T19:17:06.803","references":[{"source":"security-advisories@github.com","url":"https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-108387.json b/data/2026/CVE-2026-108387.json index bf2cbac3ab..1f1305da81 100644 --- a/data/2026/CVE-2026-108387.json +++ b/data/2026/CVE-2026-108387.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"radare2","vendor":"radareorg","versions":[{"status":"affected","version":"< 6.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2."}],"id":"CVE-2026-108387","lastModified":"2026-11-09T22:18:22.767","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:54:41.534947Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/issues/26600"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/releases/tag/6.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"radare2","vendor":"radareorg","versions":[{"status":"affected","version":"< 6.2.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radare2 to reopen the input through the debug input/output plugin and ultimately pass attacker-controlled arguments to execvp(). This could execute commands with the privileges of the radare2 process without an explicit debugging command. This issue is fixed in version 6.2.2."}],"id":"CVE-2026-108387","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108387","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:54:41.534947Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.320","references":[{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/59899e6b8b18772ce9460b4caa2ced7f257fae76"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/commit/c9de154cafd788d66535435e43ad6a54aed7ea2a"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/issues/26600"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/releases/tag/6.2.2"},{"source":"security-advisories@github.com","url":"https://github.com/radareorg/radare2/security/advisories/GHSA-px7c-gwvj-73vf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-10859.json b/data/2026/CVE-2026-10859.json index 06fca59239..1d87ea7505 100644 --- a/data/2026/CVE-2026-10859.json +++ b/data/2026/CVE-2026-10859.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads."}],"id":"CVE-2026-10859","lastModified":"2026-11-09T17:17:08.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:26.094303Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.103","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294664"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:mq:9.2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.3.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:mq:9.4.0.0:*:*:*:*:*:*:*"],"product":"MQ","vendor":"IBM","versions":[{"lessThanOrEqual":"9.2.0.44","status":"affected","version":"9.2.0.0","versionType":"semver"},{"lessThanOrEqual":"9.3.0.42","status":"affected","version":"9.3.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.0.26","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"9.4.5.1","status":"affected","version":"9.4.0.0","versionType":"semver"},{"lessThanOrEqual":"10.0.0.5","status":"affected","version":"10.0.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"44950C6B-710F-4B6B-BFAE-73E4407F51B9","versionEndExcluding":"9.2.0.46","versionStartIncluding":"9.2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"C068FAC7-7DCA-4E46-9B3F-06F513967C6A","versionEndExcluding":"9.3.0.43","versionStartIncluding":"9.3.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"9E0A65D6-9040-41E2-8B5F-3264D565E761","versionEndExcluding":"9.4.0.30","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"53BCC172-C8CC-4B55-A7C5-F262E5CC7274","versionEndIncluding":"9.4.5.1","versionStartIncluding":"9.4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:continuous_delivery:*:*:*","matchCriteriaId":"391B1041-23BF-4298-B1D3-4434C2B923CE","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq:*:*:*:*:lts:*:*:*","matchCriteriaId":"88A41538-EECC-4308-B3D8-F9742A3C2A05","versionEndExcluding":"10.0.0.6","versionStartIncluding":"10.0.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads."}],"id":"CVE-2026-10859","lastModified":"2026-11-12T21:31:32.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-10859","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T04:56:26.094303Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.103","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7294664"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-502"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-502"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-109097.json b/data/2026/CVE-2026-109097.json index 102616ca43..2b1867a915 100644 --- a/data/2026/CVE-2026-109097.json +++ b/data/2026/CVE-2026-109097.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-10T12:17:16.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"ROS#","vendor":"Siemens","versions":[{"lessThan":"V2.3.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program."}],"id":"CVE-2026-109097","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.5,"impactScore":6.0,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.223","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-435267.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"productcert@siemens.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-109797.json b/data/2026/CVE-2026-109797.json index 386bc88353..aa00b7b682 100644 --- a/data/2026/CVE-2026-109797.json +++ b/data/2026/CVE-2026-109797.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"SAP/astonish","vendor":"SAP_SE","versions":[{"status":"affected","version":"= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device."}],"id":"CVE-2026-109830","lastModified":"2026-11-10T16:17:14.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:55.344184Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.387","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-724261.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"productcert@siemens.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"meta-iot2050","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V01.03.01","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device."}],"id":"CVE-2026-109830","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.3,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-109830","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T15:46:55.344184Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.387","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-724261.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"productcert@siemens.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110003.json b/data/2026/CVE-2026-110003.json index d8f8188bd3..dba1e32810 100644 --- a/data/2026/CVE-2026-110003.json +++ b/data/2026/CVE-2026-110003.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payara Server","vendor":"Azul Payara","versions":[{"lessThan":"7.6.0","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.2026.11","status":"affected","version":"7.2024.1.Alpha1","versionType":"custom"},{"lessThan":"6.44.0","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2025.11","status":"affected","version":"6.2022.1","versionType":"custom"},{"lessThan":"5.93.0","status":"affected","version":"5.20.0","versionType":"semver"},{"lessThanOrEqual":"5.201.2","status":"affected","version":"5.181","versionType":"custom"},{"lessThanOrEqual":"5.2022.5","status":"affected","version":"5.2020.2","versionType":"custom"},{"lessThan":"4.1.2.191.61","status":"affected","version":"4.1.2.191","versionType":"custom"}]}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server."}],"id":"CVE-2026-110003","lastModified":"2026-11-12T09:16:39.813","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]},"published":"2026-11-12T09:16:39.813","references":[{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html"}],"sourceIdentifier":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payara Server","vendor":"Azul Payara","versions":[{"lessThan":"7.6.0","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThan":"7.2026.11","status":"affected","version":"7.2024.1.Alpha1","versionType":"custom"},{"lessThan":"6.44.0","status":"affected","version":"6.0.0","versionType":"semver"},{"lessThanOrEqual":"6.2025.11","status":"affected","version":"6.2022.1","versionType":"custom"},{"lessThan":"5.93.0","status":"affected","version":"5.20.0","versionType":"semver"},{"lessThanOrEqual":"5.201.2","status":"affected","version":"5.181","versionType":"custom"},{"lessThanOrEqual":"5.2022.5","status":"affected","version":"5.2020.2","versionType":"custom"},{"lessThan":"4.1.2.191.61","status":"affected","version":"4.1.2.191","versionType":"custom"}]}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waives the remote-rejection check before the token is validated, and an invalid token falls through to password-based authentication, which succeeds without credentials on default domains configured with an empty administrative password. Successful exploitation grants execution of arbitrary administrative commands, equivalent to complete compromise of the server."}],"id":"CVE-2026-110003","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]},"published":"2026-11-12T09:16:39.813","references":[{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara-community/release-notes/release-notes-7.2026.11.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/release-notes/release-notes-7.6.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/4/release-notes/release-notes-4.1.2.191.61.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/5/release-notes/release-notes-5.93.0.html"},{"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","url":"https://docs.azul.com/payara/version/6/release-notes/release-notes-6.44.0.html"}],"sourceIdentifier":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-288"}],"source":"769c9ae7-73c3-4e47-ae19-903170fc3eb8","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110181.json b/data/2026/CVE-2026-110181.json index b639f54a63..e4ff168d77 100644 --- a/data/2026/CVE-2026-110181.json +++ b/data/2026/CVE-2026-110181.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110181","lastModified":"2026-11-05T17:17:36.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:52.438624Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.473","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110181","lastModified":"2026-11-12T20:53:13.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:52.438624Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.473","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/718"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110182.json b/data/2026/CVE-2026-110182.json index ac16717ab8..4eb07a5be7 100644 --- a/data/2026/CVE-2026-110182.json +++ b/data/2026/CVE-2026-110182.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110182","lastModified":"2026-11-05T17:17:36.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:26.963712Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.590","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110182","lastModified":"2026-11-12T20:52:10.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110182","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:51:26.963712Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.590","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110183.json b/data/2026/CVE-2026-110183.json index 9cfdcfd189..a4eb56ecdd 100644 --- a/data/2026/CVE-2026-110183.json +++ b/data/2026/CVE-2026-110183.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110183","lastModified":"2026-11-05T17:17:36.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:50:57.542566Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.710","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-202"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL Anonymizer","vendor":"DALIBO","versions":[{"lessThan":"3.3.0","status":"affected","version":"1","versionType":"semver"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dalibo:postgresql_anonymizer:*:*:*:*:*:postgresql:*:*","matchCriteriaId":"06A375DD-F0FB-49E3-82DB-135793DCA922","versionEndExcluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions."}],"id":"CVE-2026-110183","lastModified":"2026-11-12T20:51:40.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:50:57.542566Z","version":"2.0.3"}}]},"published":"2026-10-28T18:17:05.710","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","tags":["Broken Link"],"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-202"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110281.json b/data/2026/CVE-2026-110281.json index 53b190b8a7..c9756c128a 100644 --- a/data/2026/CVE-2026-110281.json +++ b/data/2026/CVE-2026-110281.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique."}],"id":"CVE-2026-110281","lastModified":"2026-11-08T02:16:35.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:34:43.402907Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.253","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique."}],"id":"CVE-2026-110281","lastModified":"2026-11-12T21:34:07.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:34:43.402907Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.253","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110282.json b/data/2026/CVE-2026-110282.json index e34d831947..257fb655ca 100644 --- a/data/2026/CVE-2026-110282.json +++ b/data/2026/CVE-2026-110282.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control."}],"id":"CVE-2026-110282","lastModified":"2026-11-09T22:18:23.367","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:53:16.124713Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.410","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control."}],"id":"CVE-2026-110282","lastModified":"2026-11-12T21:34:49.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110282","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T20:53:16.124713Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.410","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110283.json b/data/2026/CVE-2026-110283.json index 6b50891f9b..145508149b 100644 --- a/data/2026/CVE-2026-110283.json +++ b/data/2026/CVE-2026-110283.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers."}],"id":"CVE-2026-110283","lastModified":"2026-11-08T02:16:35.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:44:06.490428Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.560","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-99"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers."}],"id":"CVE-2026-110283","lastModified":"2026-11-12T21:37:33.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110283","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:44:06.490428Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:48.560","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-99"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110288.json b/data/2026/CVE-2026-110288.json index 0315d2003e..c95ed95015 100644 --- a/data/2026/CVE-2026-110288.json +++ b/data/2026/CVE-2026-110288.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-110288","lastModified":"2026-11-06T19:17:07.830","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:48.946512Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:25.910","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"product-cna@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete stored Slack and Microsoft Teams ChatOps configuration and provider credentials by inducing an authenticated Management Console operator's browser to send a cross-site GET request to the integration removal endpoint without a CSRF token. Exploitation required configured ChatOps integrations and an operator visiting attacker-controlled content while signed in to the Management Console; deletion could disrupt ChatOps notifications and commands when configuration was applied or services reloaded. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fixed in versions 3.19.14, 3.20.10, 3.21.8, and 3.22.3. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-110288","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110288","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:48.946512Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:25.910","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"product-cna@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110802.json b/data/2026/CVE-2026-110802.json index 13335b4bc8..c3fd3e6810 100644 --- a/data/2026/CVE-2026-110802.json +++ b/data/2026/CVE-2026-110802.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"altair","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-express-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-fastify-plugin","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-koa-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-static","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}],"id":"CVE-2026-110802","lastModified":"2026-11-10T05:17:41.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110802","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:16:25.942801Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/releases/tag/v8.5.8"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"altair","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-express-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-fastify-plugin","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-koa-middleware","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]},{"product":"altair-static","vendor":"altair-graphql","versions":[{"status":"affected","version":">= 7.2.4, < 8.5.8"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8."}],"id":"CVE-2026-110802","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110802","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:16:25.942801Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.267","references":[{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/53a19183ce11ca147bb990c355e14ecb1dd7cd3e"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/commit/bdf422bdaaaf3186170ba7f22e22c259072133d9"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/releases/tag/v8.5.8"},{"source":"security-advisories@github.com","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/altair-graphql/altair/security/advisories/GHSA-752m-7p75-49gf"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-110930.json b/data/2026/CVE-2026-110930.json index 419d30f632..fe95f4b1fc 100644 --- a/data/2026/CVE-2026-110930.json +++ b/data/2026/CVE-2026-110930.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Codex Desktop for Windows","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.52244","status":"affected","version":"26.820.60940","versionType":"custom"},{"status":"unaffected","version":"26.1007.21434"}]},{"product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.7124.0","status":"affected","version":"26.820.7780.0","versionType":"custom"},{"status":"unaffected","version":"26.1007.2314.0"}]}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval."}],"id":"CVE-2026-110930","lastModified":"2026-11-05T21:18:35.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:28:12.900578Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:40.827","references":[{"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","url":"https://openai.com/security/advisories/cve-2026-110930/"}],"sourceIdentifier":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Codex Desktop for Windows","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.52244","status":"affected","version":"26.820.60940","versionType":"custom"},{"status":"unaffected","version":"26.1007.21434"}]},{"product":"Codex Desktop for Windows (Microsoft Store/MSIX package)","vendor":"OpenAI","versions":[{"lessThanOrEqual":"26.1002.7124.0","status":"affected","version":"26.820.7780.0","versionType":"custom"},{"status":"unaffected","version":"26.1007.2314.0"}]}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user selects \"Open project in ChatGPT\" for an attacker-controlled library's child item, the path can add application startup arguments. These arguments can run attacker-controlled code with the current Windows user's permissions before sign-in or project trust approval."}],"id":"CVE-2026-110930","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.1,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-110930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:28:12.900578Z","version":"2.0.3"}}]},"published":"2026-11-05T20:17:40.827","references":[{"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","url":"https://openai.com/security/advisories/cve-2026-110930/"}],"sourceIdentifier":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"8f4f43ab-ba69-4d92-aa1d-d772184d6fb7","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111433.json b/data/2026/CVE-2026-111433.json index 408067250e..0ffdfe50a1 100644 --- a/data/2026/CVE-2026-111433.json +++ b/data/2026/CVE-2026-111433.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read."}],"id":"CVE-2026-111433","lastModified":"2026-11-12T10:17:27.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.160","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"securities@openeuler.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIf an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read."}],"id":"CVE-2026-111433","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.160","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/3af9a2bf517b570fe20b1ee1070668a6270d6e11?ref=master&prId=2652"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-61"}],"source":"securities@openeuler.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111434.json b/data/2026/CVE-2026-111434.json index a31fba99dc..73056ccd08 100644 --- a/data/2026/CVE-2026-111434.json +++ b/data/2026/CVE-2026-111434.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes."}],"id":"CVE-2026-111434","lastModified":"2026-11-12T10:17:27.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":4.7,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.327","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"securities@openeuler.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of Externally-Controlled format string vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nWhen the iSulad daemon performs container lifecycle operations (such as create, start, exec, stop, etc.) through the isula runtime (shim), the daemon reads the stderr output of the shim process via a pipe for error information display. If the buffer contains format specifiers such as %s, %x, or %n, it may trigger a format string vulnerability, potentially leading to information leakage, denial of service, or the risk of arbitrary writes."}],"id":"CVE-2026-111434","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":4.7,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.327","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/697cb26a5946d56bbb2c5533bab72f4376d8421b?ref=master&prId=2650"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-134"}],"source":"securities@openeuler.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111435.json b/data/2026/CVE-2026-111435.json index 070ac50fe4..56b00c022c 100644 --- a/data/2026/CVE-2026-111435.json +++ b/data/2026/CVE-2026-111435.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host."}],"id":"CVE-2026-111435","lastModified":"2026-11-12T10:17:27.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.483","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"securities@openeuler.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host."}],"id":"CVE-2026-111435","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.483","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"securities@openeuler.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111436.json b/data/2026/CVE-2026-111436.json index c47cef564e..b830d2e479 100644 --- a/data/2026/CVE-2026-111436.json +++ b/data/2026/CVE-2026-111436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"unaffected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nThe memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS)."}],"id":"CVE-2026-111436","lastModified":"2026-11-12T10:17:27.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.630","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/d48130e6d16d603a9c12333b03bd74d63891ab87?ref=master&prId=2651"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"securities@openeuler.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"unaffected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/spec/specs_mount.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of memory after effective lifetime vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nThe memory leak vulnerability causes the iSulad daemon to be triggered frequently, exhausting the host machine's memory and ultimately leading to an OOM crash of the daemon, resulting in a denial of service (DoS)."}],"id":"CVE-2026-111436","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":3.6,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.630","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/d48130e6d16d603a9c12333b03bd74d63891ab87?ref=master&prId=2651"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"securities@openeuler.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111753.json b/data/2026/CVE-2026-111753.json index 981adcee91..19b5b0e2a6 100644 --- a/data/2026/CVE-2026-111753.json +++ b/data/2026/CVE-2026-111753.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.34"},{"status":"affected","version":">= 21.0.0, < 21.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3."}],"id":"CVE-2026-111753","lastModified":"2026-11-09T23:17:11.570","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:52:28.681840Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71294"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/65683"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71295"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-359"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"angular","vendor":"angular","versions":[{"status":"affected","version":"<= 19.2.25"},{"status":"affected","version":">= 20.0.0, < 20.3.34"},{"status":"affected","version":">= 21.0.0, < 21.0.3"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3."}],"id":"CVE-2026-111753","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111753","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:52:28.681840Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.800","references":[{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/20474d3f0fd7c64071add6e84acf720627e5c19b"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/commit/933ce817d53e25926844fa56af8230816763d08e"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/issues/71294"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/65683"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/pull/71295"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/21.0.3"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/releases/tag/v20.3.34"},{"source":"security-advisories@github.com","url":"https://github.com/angular/angular/security/advisories/GHSA-jfgx-762w-99vr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-359"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111768.json b/data/2026/CVE-2026-111768.json index 22fdc7d413..7bb6af399f 100644 --- a/data/2026/CVE-2026-111768.json +++ b/data/2026/CVE-2026-111768.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111768","lastModified":"2026-11-09T18:17:19.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111768","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:49.133793Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.457","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2926"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2927"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.3.0, < 1.32.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request within the default 4 MiB limit can terminate the process with JavaScript heap exhaustion. No credentials are required unless the application authenticates before SDK processing. Tools accepting arrays or records carry the greatest risk. stdio-only servers do not expose the HTTP request path. Upgrading alone does not enable the new validation bound. Operators must configure both a tool-input element bound and an appropriate request body size limit. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/server 2.3.0."}],"id":"CVE-2026-111768","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111768","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:38:49.133793Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.457","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2926"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2927"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111769.json b/data/2026/CVE-2026-111769.json index 9f67849c6b..d31c4f291d 100644 --- a/data/2026/CVE-2026-111769.json +++ b/data/2026/CVE-2026-111769.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"client","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0."}],"id":"CVE-2026-111769","lastModified":"2026-11-09T19:16:39.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T18:39:42.557072Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.637","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2902"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":"< 1.32.0"}]},{"product":"client","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0."}],"id":"CVE-2026-111769","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T18:39:42.557072Z","version":"2.0.3"}}]},"published":"2026-11-05T22:17:45.637","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2901"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2902"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-111771.json b/data/2026/CVE-2026-111771.json index 6343b724a1..174949f65c 100644 --- a/data/2026/CVE-2026-111771.json +++ b/data/2026/CVE-2026-111771.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"express","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.0.2"}]},{"product":"server-legacy","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}],"id":"CVE-2026-111771","lastModified":"2026-11-10T05:17:42.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:21:00.140745Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.973","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"typescript-sdk","vendor":"modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"sdk","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 1.6.0, < 1.32.0"}]},{"product":"server","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.0"}]},{"product":"express","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.0.2"}]},{"product":"server-legacy","vendor":"@modelcontextprotocol","versions":[{"status":"affected","version":">= 2.0.0, < 2.3.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1."}],"id":"CVE-2026-111771","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-111771","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T04:21:00.140745Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:35.973","references":[{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2929"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2930"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/pull/2952"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0"},{"source":"security-advisories@github.com","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112136.json b/data/2026/CVE-2026-112136.json index 33dcca1b89..572afb010b 100644 --- a/data/2026/CVE-2026-112136.json +++ b/data/2026/CVE-2026-112136.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely."}],"id":"CVE-2026-112136","lastModified":"2026-11-10T17:17:20.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:34:00.788095Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.540","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"productcert@siemens.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely."}],"id":"CVE-2026-112136","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"productcert@siemens.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112136","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:34:00.788095Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:16.540","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1327"}],"source":"productcert@siemens.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112137.json b/data/2026/CVE-2026-112137.json index 08e4d40560..8e6e41448b 100644 --- a/data/2026/CVE-2026-112137.json +++ b/data/2026/CVE-2026-112137.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server."}],"id":"CVE-2026-112137","lastModified":"2026-11-10T12:17:16.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.697","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"productcert@siemens.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Mendix Studio Pro 11","vendor":"Siemens","versions":[{"lessThan":"V11.16.0","status":"affected","version":"V11.15.0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"Mendix Studio Pro 11.12","vendor":"Siemens","versions":[{"lessThan":"V11.12.7","status":"affected","version":"V11.12.6","versionType":"custom"}]}],"source":"productcert@siemens.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server."}],"id":"CVE-2026-112137","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"productcert@siemens.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"productcert@siemens.com","type":"Secondary"}]},"published":"2026-11-10T12:17:16.697","references":[{"source":"productcert@siemens.com","url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}],"sourceIdentifier":"productcert@siemens.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"productcert@siemens.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-112354.json b/data/2026/CVE-2026-112354.json index 4b93f4ed8b..c11dfb337d 100644 --- a/data/2026/CVE-2026-112354.json +++ b/data/2026/CVE-2026-112354.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Etrel INCH","vendor":"Etrel d.o.o.","versions":[{"lessThan":"7.1.2","status":"affected","version":"0","versionType":"semver"},{"lessThan":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station."}],"id":"CVE-2026-112354","lastModified":"2026-11-07T04:17:12.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:35:46.880664Z","version":"2.0.3"}}]},"published":"2026-11-03T22:17:44.660","references":[{"source":"disclosure@vulncheck.com","url":"https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware"},{"source":"disclosure@vulncheck.com","url":"https://etrel.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Etrel INCH","vendor":"Etrel d.o.o.","versions":[{"lessThan":"7.1.2","status":"affected","version":"0","versionType":"semver"},{"lessThan":"8.0.1","status":"affected","version":"8.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over cleartext HTTP to obtain complete charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, enabling unauthorized administrative control of the charging station."}],"id":"CVE-2026-112354","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:35:46.880664Z","version":"2.0.3"}}]},"published":"2026-11-03T22:17:44.660","references":[{"source":"disclosure@vulncheck.com","url":"https://etrel.atlassian.net/wiki/spaces/EKC/pages/5064097853/Etrel+INCH+Firmware"},{"source":"disclosure@vulncheck.com","url":"https://etrel.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/etrel-inch-ac-charging-station-hard-coded-default-credentials"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1392"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112369.json b/data/2026/CVE-2026-112369.json index dc4f93ba12..4cab77c2ed 100644 --- a/data/2026/CVE-2026-112369.json +++ b/data/2026/CVE-2026-112369.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms."}],"id":"CVE-2026-112369","lastModified":"2026-11-08T17:16:36.387","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T17:16:36.277","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"],"product":"Process Mining","vendor":"IBM","versions":[{"lessThanOrEqual":"2.2.1","status":"affected","version":"2.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms."}],"id":"CVE-2026-112369","lastModified":"2026-11-12T21:17:19.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:09:04.898403Z","version":"2.0.3"}}]},"published":"2026-11-08T17:16:36.277","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7294875"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-602"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112803.json b/data/2026/CVE-2026-112803.json index 0860a27528..bd0e240d10 100644 --- a/data/2026/CVE-2026-112803.json +++ b/data/2026/CVE-2026-112803.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112803","lastModified":"2026-11-12T19:16:46.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:22:15.539860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:42.843","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112803"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112803","lastModified":"2026-11-12T22:18:09.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:22:15.539860Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:42.843","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112803"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"secure@microsoft.com","type":"Primary"},{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-112809.json b/data/2026/CVE-2026-112809.json index 4dcc7de2a7..a9b05f6107 100644 --- a/data/2026/CVE-2026-112809.json +++ b/data/2026/CVE-2026-112809.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112809","lastModified":"2026-11-12T19:16:46.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:21:05.582137Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:45.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112809"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows Composite Image File System allows an authorized attacker to disclose information locally."}],"id":"CVE-2026-112809","lastModified":"2026-11-12T22:18:10.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-112809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:21:05.582137Z","version":"2.0.3"}}]},"published":"2026-11-10T19:18:45.440","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-112809"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"secure@microsoft.com","type":"Primary"},{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-11315.json b/data/2026/CVE-2026-11315.json index 2df1213a86..07cfada7d1 100644 --- a/data/2026/CVE-2026-11315.json +++ b/data/2026/CVE-2026-11315.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dr_libs","vendor":"mackron","versions":[{"status":"affected","version":"0.7.3"}]}],"source":"talos-cna@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability."}],"id":"CVE-2026-11315","lastModified":"2026-11-10T16:17:17.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"talos-cna@cisco.com","type":"Primary"}]},"published":"2026-11-10T16:17:17.310","references":[{"source":"talos-cna@cisco.com","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2441"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"talos-cna@cisco.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dr_libs","vendor":"mackron","versions":[{"status":"affected","version":"0.7.3"}]}],"source":"talos-cna@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability."}],"id":"CVE-2026-11315","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"talos-cna@cisco.com","type":"Primary"}]},"published":"2026-11-10T16:17:17.310","references":[{"source":"talos-cna@cisco.com","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2441"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"talos-cna@cisco.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-11316.json b/data/2026/CVE-2026-11316.json index 5cc3e00b98..850ebd60db 100644 --- a/data/2026/CVE-2026-11316.json +++ b/data/2026/CVE-2026-11316.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dr_libs","vendor":"mackron","versions":[{"status":"affected","version":"0.14.5"}]}],"source":"talos-cna@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability."}],"id":"CVE-2026-11316","lastModified":"2026-11-10T16:17:17.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"talos-cna@cisco.com","type":"Primary"}]},"published":"2026-11-10T16:17:17.453","references":[{"source":"talos-cna@cisco.com","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2442"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"talos-cna@cisco.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"dr_libs","vendor":"mackron","versions":[{"status":"affected","version":"0.14.5"}]}],"source":"talos-cna@cisco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially crafted .wav file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability."}],"id":"CVE-2026-11316","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"talos-cna@cisco.com","type":"Primary"}]},"published":"2026-11-10T16:17:17.453","references":[{"source":"talos-cna@cisco.com","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2026-2442"}],"sourceIdentifier":"talos-cna@cisco.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"talos-cna@cisco.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-113362.json b/data/2026/CVE-2026-113362.json index 1992eb6d68..122d34b497 100644 --- a/data/2026/CVE-2026-113362.json +++ b/data/2026/CVE-2026-113362.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL file that is loaded by a SYSTEM-level process."}],"id":"CVE-2026-113362","lastModified":"2026-11-10T14:17:12.663","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:10:38.797559Z","version":"2.0.3"}}]},"published":"2026-11-09T04:17:06.133","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a crafted DLL file that is loaded by a SYSTEM-level process."}],"id":"CVE-2026-113362","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113362","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:10:38.797559Z","version":"2.0.3"}}]},"published":"2026-11-09T04:17:06.133","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-276"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113363.json b/data/2026/CVE-2026-113363.json index 78dcf4ad80..42b0a18ba1 100644 --- a/data/2026/CVE-2026-113363.json +++ b/data/2026/CVE-2026-113363.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running."}],"id":"CVE-2026-113363","lastModified":"2026-11-10T14:17:12.827","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113363","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:49.205231Z","version":"2.0.3"}}]},"published":"2026-11-09T05:18:26.107","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-749"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet sent to the computer on which WinShare is running."}],"id":"CVE-2026-113363","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113363","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:49.205231Z","version":"2.0.3"}}]},"published":"2026-11-09T05:18:26.107","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-749"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113364.json b/data/2026/CVE-2026-113364.json index 7afe5f1a1b..c52a351fae 100644 --- a/data/2026/CVE-2026-113364.json +++ b/data/2026/CVE-2026-113364.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header."}],"id":"CVE-2026-113364","lastModified":"2026-11-10T14:17:12.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113364","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:10.782074Z","version":"2.0.3"}}]},"published":"2026-11-09T05:18:26.810","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WebSAM WinShare","vendor":"NEC Corporation","versions":[{"status":"affected","version":"Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2"}]}],"source":"psirt-info@cyber.jp.nec.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value in the protocol header."}],"id":"CVE-2026-113364","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113364","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T14:09:10.782074Z","version":"2.0.3"}}]},"published":"2026-11-09T05:18:26.810","references":[{"source":"psirt-info@cyber.jp.nec.com","url":"https://jpn.nec.com/security-info/secinfo/nv26-006_en.html"}],"sourceIdentifier":"psirt-info@cyber.jp.nec.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"psirt-info@cyber.jp.nec.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113663.json b/data/2026/CVE-2026-113663.json index e35c4eb677..91390cd3bd 100644 --- a/data/2026/CVE-2026-113663.json +++ b/data/2026/CVE-2026-113663.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ag2","vendor":"ag2ai","versions":[{"status":"affected","version":">= 0.13.2, < 1.1.1"}]},{"product":"autogen","vendor":"ag2ai","versions":[{"status":"affected","version":">= 0.13.2, <= 0.14.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1."}],"id":"CVE-2026-113663","lastModified":"2026-11-09T18:17:20.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:37:11.466545Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:50.523","references":[{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39"},{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/releases/tag/v1.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ag2","vendor":"ag2ai","versions":[{"status":"affected","version":">= 0.13.2, < 1.1.1"}]},{"product":"autogen","vendor":"ag2ai","versions":[{"status":"affected","version":">= 0.13.2, <= 0.14.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AG2 is an open-source AgentOS. From 0.13.2 until ag2 1.1.1, and from autogen 0.13.2 to 0.14.1, SandboxShellTool configurations using allowed=[...] or readonly=True rely on ShellAdapter._filter and contains_shell_operator in ag2/tools/sandbox/filter.py and ag2/tools/sandbox/adapter/shell.py to validate a command prefix and reject selected shell syntax. The filter omits newline and carriage-return separators, while the accepted raw string is passed to sh -c, allowing an attacker-influenced agent command to execute an additional arbitrary statement. With the default LocalEnvironment backend, the injected statement runs as a host subprocess with the privileges of the agent process and can affect confidentiality, integrity, and availability. This issue is fixed in ag2 version 1.1.1."}],"id":"CVE-2026-113663","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:37:11.466545Z","version":"2.0.3"}}]},"published":"2026-11-05T23:16:50.523","references":[{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/commit/3cd86726bb731eb11d6270f0ef9e50e42b5abb39"},{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/releases/tag/v1.1.1"},{"source":"security-advisories@github.com","url":"https://github.com/ag2ai/ag2/security/advisories/GHSA-2h4w-29cv-2cmv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-184"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113780.json b/data/2026/CVE-2026-113780.json index 17dbcaf11f..28b2a902ce 100644 --- a/data/2026/CVE-2026-113780.json +++ b/data/2026/CVE-2026-113780.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":"< 5.5.6"},{"status":"affected","version":">= 6.0.0, < 6.0.4"},{"status":"affected","version":">= 6.1.0, < 6.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1."}],"id":"CVE-2026-113780","lastModified":"2026-11-05T19:17:09.523","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:10:46.416008Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.493","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/b85a7b0e1449ac9aec30a0c3e3b6515725556fd1"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/dabd37fae8d2a7b1cc71f48fce824b0b9d909a07"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/releases/tag/v5.5.6"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-822"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"esp-idf","vendor":"espressif","versions":[{"status":"affected","version":"< 5.5.6"},{"status":"affected","version":">= 6.0.0, < 6.0.4"},{"status":"affected","version":">= 6.1.0, < 6.1.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary and potentially corrupting TEE control-flow data for code execution, denial of service, or system crashes. Both secure-service ecall and interrupt entry paths contain the vulnerable ordering. This issue is fixed in version 5.5.6 and is scheduled to be fixed in versions 6.0.4 and 6.1.1."}],"id":"CVE-2026-113780","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.5,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:10:46.416008Z","version":"2.0.3"}}]},"published":"2026-11-04T19:17:18.493","references":[{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/773761abb893d43d0a5b8b75ec0a1c2cf0287d53"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/acb7d996b07293abf591b93f4aaffa04ae6732d9"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/b85a7b0e1449ac9aec30a0c3e3b6515725556fd1"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/commit/dabd37fae8d2a7b1cc71f48fce824b0b9d909a07"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/releases/tag/v5.5.6"},{"source":"security-advisories@github.com","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-49x8-xqjg-2pjg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"},{"lang":"en","value":"CWE-822"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113843.json b/data/2026/CVE-2026-113843.json index 054c30363f..738e0b6046 100644 --- a/data/2026/CVE-2026-113843.json +++ b/data/2026/CVE-2026-113843.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-113843","lastModified":"2026-11-12T20:18:16.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:31.541027Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:05.373","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113843"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1607","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2016 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.14393.9688","status":"affected","version":"10.0.14393.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper authentication in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally."}],"id":"CVE-2026-113843","lastModified":"2026-11-12T22:18:19.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:07:31.541027Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:05.373","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113843"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"secure@microsoft.com","type":"Primary"},{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113960.json b/data/2026/CVE-2026-113960.json index 219d67403e..925abc70e1 100644 --- a/data/2026/CVE-2026-113960.json +++ b/data/2026/CVE-2026-113960.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined."}],"id":"CVE-2026-113960","lastModified":"2026-11-12T18:17:13.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:36:45.582113Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:25.760","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined."}],"id":"CVE-2026-113960","lastModified":"2026-11-12T22:18:21.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113960","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:36:45.582113Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:25.760","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113961.json b/data/2026/CVE-2026-113961.json index e7f39aad18..e75ff1b9d1 100644 --- a/data/2026/CVE-2026-113961.json +++ b/data/2026/CVE-2026-113961.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages."}],"id":"CVE-2026-113961","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113961","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:34.801658Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:25.917","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved validation. This issue is fixed in HomeView Software Version 27.2, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages."}],"id":"CVE-2026-113961","lastModified":"2026-11-12T22:18:21.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113961","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:34.801658Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:25.917","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113963.json b/data/2026/CVE-2026-113963.json index 00aafd93bb..a43e67a94e 100644 --- a/data/2026/CVE-2026-113963.json +++ b/data/2026/CVE-2026-113963.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data."}],"id":"CVE-2026-113963","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113963","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:13.966430Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.087","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 27.2.1 and iPadOS 27.2.1, visionOS 27.2.1, watchOS 27.2.1. An app may be able to access sensitive user data."}],"id":"CVE-2026-113963","lastModified":"2026-11-12T22:18:21.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113963","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:02:13.966430Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.087","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113964.json b/data/2026/CVE-2026-113964.json index d187be1e69..ef3a5d830d 100644 --- a/data/2026/CVE-2026-113964.json +++ b/data/2026/CVE-2026-113964.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction."}],"id":"CVE-2026-113964","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113964","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:40.859338Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.267","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction."}],"id":"CVE-2026-113964","lastModified":"2026-11-12T22:18:21.733","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113964","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:01:40.859338Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.267","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113965.json b/data/2026/CVE-2026-113965.json index 1138551aa9..f3958a5d7d 100644 --- a/data/2026/CVE-2026-113965.json +++ b/data/2026/CVE-2026-113965.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed with improved checks. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction."}],"id":"CVE-2026-113965","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:00:41.584440Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.457","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. A malicious Bluetooth device may be able to establish a pairing without user interaction."}],"id":"CVE-2026-113965","lastModified":"2026-11-12T22:18:21.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113965","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:00:41.584440Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.457","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113968.json b/data/2026/CVE-2026-113968.json index d11bbb774f..c3b3ad1f54 100644 --- a/data/2026/CVE-2026-113968.json +++ b/data/2026/CVE-2026-113968.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts."}],"id":"CVE-2026-113968","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113968","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:08:21.672742Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.627","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts."}],"id":"CVE-2026-113968","lastModified":"2026-11-12T22:18:22.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113968","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:08:21.672742Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.627","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113969.json b/data/2026/CVE-2026-113969.json index 8249f65669..7dba57ddb6 100644 --- a/data/2026/CVE-2026-113969.json +++ b/data/2026/CVE-2026-113969.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."}],"id":"CVE-2026-113969","lastModified":"2026-11-12T18:17:13.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113969","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:50.718860Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.800","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts."}],"id":"CVE-2026-113969","lastModified":"2026-11-12T22:18:22.460","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113969","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:37:50.718860Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.800","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-113970.json b/data/2026/CVE-2026-113970.json index 1c06ff8fa0..5eb66efee6 100644 --- a/data/2026/CVE-2026-113970.json +++ b/data/2026/CVE-2026-113970.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory."}],"id":"CVE-2026-113970","lastModified":"2026-11-10T21:51:05.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.903","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"HomeView Software","vendor":"Apple","versions":[{"lessThan":"27.2","status":"affected","version":"0","versionType":"custom"}]},{"product":"iOS and iPadOS","vendor":"Apple","versions":[{"lessThan":"18.7.12","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"macOS","vendor":"Apple","versions":[{"lessThan":"15.8.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"26.7.3","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"visionOS","vendor":"Apple","versions":[{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]},{"product":"watchOS","vendor":"Apple","versions":[{"lessThan":"26.6.1","status":"affected","version":"0","versionType":"custom"},{"lessThan":"27.2.1","status":"affected","version":"0","versionType":"custom"}]}],"source":"product-security@apple.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free issue was addressed with improved memory management. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and iPadOS 18.7.12, iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 26.6.1, watchOS 27.2.1. An attacker in Bluetooth range may be able to corrupt process memory."}],"id":"CVE-2026-113970","lastModified":"2026-11-12T22:18:22.690","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-113970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-11-09T22:18:26.903","references":[{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149715"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149716"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149717"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149718"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149719"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149720"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149722"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149723"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149724"},{"source":"product-security@apple.com","url":"https://support.apple.com/en-us/149851"}],"sourceIdentifier":"product-security@apple.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114031.json b/data/2026/CVE-2026-114031.json index 7dd1f6246d..e8c525fbc8 100644 --- a/data/2026/CVE-2026-114031.json +++ b/data/2026/CVE-2026-114031.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.12-S1","status":"affected","version":"26.2.12","versionType":"semver"},{"lessThan":"25.2.41-S1","status":"affected","version":"25.2.41","versionType":"semver"},{"lessThan":"25.2.40-S1","status":"affected","version":"25.2.40","versionType":"semver"},{"lessThan":"25.2.31-S1","status":"affected","version":"25.2.31","versionType":"semver"},{"lessThan":"25.2.20-S1","status":"affected","version":"25.2.20","versionType":"semver"},{"lessThan":"25.2.10-S1","status":"affected","version":"25.2.10","versionType":"semver"},{"lessThan":"24.2.40-S1","status":"affected","version":"24.2.40","versionType":"semver"},{"lessThan":"24.2.35-S1","status":"affected","version":"24.2.35","versionType":"semver"},{"lessThan":"24.2.30-S1","status":"affected","version":"24.2.30","versionType":"semver"},{"lessThan":"24.2.20-S1","status":"affected","version":"24.2.20","versionType":"semver"},{"lessThan":"24.2.11-S1","status":"affected","version":"24.2.11","versionType":"semver"},{"lessThan":"24.2.10-S1","status":"affected","version":"24.2.10","versionType":"semver"},{"lessThan":"23.2.31-S1","status":"affected","version":"23.2.31","versionType":"semver"},{"lessThan":"23.2.31-LA-S1","status":"affected","version":"23.2.31-LA","versionType":"semver"},{"lessThan":"23.2.30-S1","status":"affected","version":"23.2.30","versionType":"semver"},{"lessThan":"23.2.24-S1","status":"affected","version":"23.2.24","versionType":"semver"},{"lessThan":"23.2.24-LA-S1","status":"affected","version":"23.2.24-LA","versionType":"semver"},{"lessThan":"23.2.23-S1","status":"affected","version":"23.2.23","versionType":"semver"},{"lessThan":"23.2.22-S1","status":"affected","version":"23.2.22","versionType":"semver"},{"lessThan":"23.2.22-LA-S1","status":"affected","version":"23.2.22-LA","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account."}],"id":"CVE-2026-114031","lastModified":"2026-11-12T17:17:23.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:10:35.342224Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.257","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/insecure-folder-permissions-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@illumio.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.12-S1","status":"affected","version":"26.2.12","versionType":"semver"},{"lessThan":"25.2.41-S1","status":"affected","version":"25.2.41","versionType":"semver"},{"lessThan":"25.2.40-S1","status":"affected","version":"25.2.40","versionType":"semver"},{"lessThan":"25.2.31-S1","status":"affected","version":"25.2.31","versionType":"semver"},{"lessThan":"25.2.20-S1","status":"affected","version":"25.2.20","versionType":"semver"},{"lessThan":"25.2.10-S1","status":"affected","version":"25.2.10","versionType":"semver"},{"lessThan":"24.2.40-S1","status":"affected","version":"24.2.40","versionType":"semver"},{"lessThan":"24.2.35-S1","status":"affected","version":"24.2.35","versionType":"semver"},{"lessThan":"24.2.30-S1","status":"affected","version":"24.2.30","versionType":"semver"},{"lessThan":"24.2.20-S1","status":"affected","version":"24.2.20","versionType":"semver"},{"lessThan":"24.2.11-S1","status":"affected","version":"24.2.11","versionType":"semver"},{"lessThan":"24.2.10-S1","status":"affected","version":"24.2.10","versionType":"semver"},{"lessThan":"23.2.31-S1","status":"affected","version":"23.2.31","versionType":"semver"},{"lessThan":"23.2.31-LA-S1","status":"affected","version":"23.2.31-LA","versionType":"semver"},{"lessThan":"23.2.30-S1","status":"affected","version":"23.2.30","versionType":"semver"},{"lessThan":"23.2.24-S1","status":"affected","version":"23.2.24","versionType":"semver"},{"lessThan":"23.2.24-LA-S1","status":"affected","version":"23.2.24-LA","versionType":"semver"},{"lessThan":"23.2.23-S1","status":"affected","version":"23.2.23","versionType":"semver"},{"lessThan":"23.2.22-S1","status":"affected","version":"23.2.22","versionType":"semver"},{"lessThan":"23.2.22-LA-S1","status":"affected","version":"23.2.22-LA","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account."}],"id":"CVE-2026-114031","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114031","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:10:35.342224Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.257","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/insecure-folder-permissions-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"security@illumio.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114032.json b/data/2026/CVE-2026-114032.json index 7d12fec8f6..e0749040c6 100644 --- a/data/2026/CVE-2026-114032.json +++ b/data/2026/CVE-2026-114032.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.20","status":"affected","version":"24.2.20","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges."}],"id":"CVE-2026-114032","lastModified":"2026-11-12T18:17:13.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:14:02.415605Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.397","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/untrusted-openssl-configuration-load-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"security@illumio.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Core Ven","vendor":"Illumio","versions":[{"lessThan":"26.2.20","status":"affected","version":"24.2.20","versionType":"semver"}]}],"source":"security@illumio.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The OpenSSL library bundled with the Illumio VEN for Windows is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code with SYSTEM privileges."}],"id":"CVE-2026-114032","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"security@illumio.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114032","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T17:14:02.415605Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:27.397","references":[{"source":"security@illumio.com","url":"https://product-docs-repo.illumio.com/Tech-Docs/Security+Advisories/out/en/security-advisories/untrusted-openssl-configuration-load-in-the-windows-ven.html"}],"sourceIdentifier":"security@illumio.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-427"}],"source":"security@illumio.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114134.json b/data/2026/CVE-2026-114134.json index 2633a39cfe..a2c91313ef 100644 --- a/data/2026/CVE-2026-114134.json +++ b/data/2026/CVE-2026-114134.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"black","vendor":"psf","versions":[{"status":"affected","version":"< 26.10.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1."}],"id":"CVE-2026-114134","lastModified":"2026-11-09T18:17:20.997","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:37:05.046230Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:36.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514"},{"source":"security-advisories@github.com","url":"https://github.com/psf/black/pull/5510"},{"source":"security-advisories@github.com","url":"https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"black","vendor":"psf","versions":[{"status":"affected","version":"< 26.10.1"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Black is the uncompromising Python code formatter. Prior to 26.10.1, the Black GitHub Action with use_pyproject: true accepts tool.black.required-version from pyproject.toml without validating that it is a released Black version specifier. An attacker who can submit a pull request can change that field to a direct reference to attacker-controlled code, causing the workflow to install and execute the code in the victim repository's GitHub Actions context. This issue is fixed in version 26.10.1."}],"id":"CVE-2026-114134","lastModified":"2026-11-12T22:18:35.610","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:37:05.046230Z","version":"2.0.3"}}]},"published":"2026-11-05T21:18:36.887","references":[{"source":"security-advisories@github.com","url":"https://github.com/psf/black/commit/ac1f71563aeccf73cf13ece00f231d9d6c66a514"},{"source":"security-advisories@github.com","url":"https://github.com/psf/black/pull/5510"},{"source":"security-advisories@github.com","url":"https://github.com/psf/black/security/advisories/GHSA-cg8m-r9f2-5wm2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-829"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114369.json b/data/2026/CVE-2026-114369.json index 590831ff19..b8e19bf52d 100644 --- a/data/2026/CVE-2026-114369.json +++ b/data/2026/CVE-2026-114369.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtwebsockets"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"5.15.0","status":"unknown","version":"0","versionType":"python"},{"lessThanOrEqual":"6.8.9","status":"affected","version":"5.15.0","versionType":"python"},{"lessThanOrEqual":"6.12.0","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module"}],"id":"CVE-2026-114369","lastModified":"2026-11-12T12:18:19.057","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.7,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"CLEAR","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:L/U:Clear","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-12T12:18:19.057","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://www.qt.io/security-advisories?search=CVE-2026-114369"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtwebsockets:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtwebsockets"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"5.15.0","status":"unknown","version":"0","versionType":"python"},{"lessThanOrEqual":"6.8.9","status":"affected","version":"5.15.0","versionType":"python"},{"lessThanOrEqual":"6.12.0","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module"}],"id":"CVE-2026-114369","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.7,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"CLEAR","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:L/U:Clear","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]},"published":"2026-11-12T12:18:19.057","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772144"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772145"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtwebsockets/+/772146"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://www.qt.io/security-advisories?search=CVE-2026-114369"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-407"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-114594.json b/data/2026/CVE-2026-114594.json index 3fe6cf3ad0..30dfe728b0 100644 --- a/data/2026/CVE-2026-114594.json +++ b/data/2026/CVE-2026-114594.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Sandisk Dashboard","vendor":"Sandisk","versions":[{"lessThanOrEqual":"5.2.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3."}],"id":"CVE-2026-114594","lastModified":"2026-11-12T17:17:24.167","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:43:46.843251Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:10.583","references":[{"source":"634960e2-700d-44e8-9cc5-06f1161e61db","url":"https://www.sandisk.com/support/product-security/sdc-26001-sandisk-dashboard-app-version-5-3-2-4"}],"sourceIdentifier":"634960e2-700d-44e8-9cc5-06f1161e61db","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-379"}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"Sandisk Dashboard","vendor":"Sandisk","versions":[{"lessThanOrEqual":"5.2.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated installer then executes the attacker-controlled binary, resulting in local privilege escalation to a high-integrity (administrative) context. This issue affects Sandisk Dashboard through 5.2.2.3."}],"id":"CVE-2026-114594","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-114594","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:43:46.843251Z","version":"2.0.3"}}]},"published":"2026-11-09T17:17:10.583","references":[{"source":"634960e2-700d-44e8-9cc5-06f1161e61db","url":"https://www.sandisk.com/support/product-security/sdc-26001-sandisk-dashboard-app-version-5-3-2-4"}],"sourceIdentifier":"634960e2-700d-44e8-9cc5-06f1161e61db","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"},{"lang":"en","value":"CWE-379"}],"source":"634960e2-700d-44e8-9cc5-06f1161e61db","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115738.json b/data/2026/CVE-2026-115738.json index 460ced6865..f35975714b 100644 --- a/data/2026/CVE-2026-115738.json +++ b/data/2026/CVE-2026-115738.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries."}],"id":"CVE-2026-115738","lastModified":"2026-11-05T17:17:42.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:16:26.291069Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.177","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries."}],"id":"CVE-2026-115738","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:16:26.291069Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:17.177","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115739.json b/data/2026/CVE-2026-115739.json index 931714bd8b..981f48bf7b 100644 --- a/data/2026/CVE-2026-115739.json +++ b/data/2026/CVE-2026-115739.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files."}],"id":"CVE-2026-115739","lastModified":"2026-11-05T19:17:10.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:01:03.885472Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:34.367","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files."}],"id":"CVE-2026-115739","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:01:03.885472Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:34.367","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-321"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115740.json b/data/2026/CVE-2026-115740.json index f0faff884e..e9857b26f6 100644 --- a/data/2026/CVE-2026-115740.json +++ b/data/2026/CVE-2026-115740.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host."}],"id":"CVE-2026-115740","lastModified":"2026-11-05T17:17:42.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:08:29.386652Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:34.510","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"DLP on-prem extensions","vendor":"Trellix","versions":[{"status":"affected","version":"11.13.1 and earlier"}]}],"source":"trellixpsirt@trellix.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host."}],"id":"CVE-2026-115740","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"trellixpsirt@trellix.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115740","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T17:08:29.386652Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:34.510","references":[{"source":"trellixpsirt@trellix.com","url":"https://support.trellix.com/s/article/000015949"}],"sourceIdentifier":"trellixpsirt@trellix.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"trellixpsirt@trellix.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115770.json b/data/2026/CVE-2026-115770.json index 7f7f11a23f..f3600823f3 100644 --- a/data/2026/CVE-2026-115770.json +++ b/data/2026/CVE-2026-115770.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"pocket-id","vendor":"pocket-id","versions":[{"status":"affected","version":">= 2.2.0, < 2.12.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true. The default affected configuration uses emailsVerified=false and allowOwnAccountEdit=true; the target address must not already belong to another Pocket ID user. A relying application that trusts a verified email for automatic account matching or provisioning can link the attacker's identity to another user's account, while applications that rely exclusively on the stable OIDC sub claim are not affected by that downstream consequence. This issue is fixed in version 2.12.0."}],"id":"CVE-2026-115770","lastModified":"2026-11-09T22:18:28.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115770","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:57:41.783368Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.767","references":[{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/commit/43aaccd5bfacb76283b11ce039fb3f0716196fcb"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/pull/1625"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/releases/tag/v2.12.0"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-rm8c-2cv8-jwf6"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-rm8c-2cv8-jwf6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"pocket-id","vendor":"pocket-id","versions":[{"status":"affected","version":">= 2.2.0, < 2.12.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true. The default affected configuration uses emailsVerified=false and allowOwnAccountEdit=true; the target address must not already belong to another Pocket ID user. A relying application that trusts a verified email for automatic account matching or provisioning can link the attacker's identity to another user's account, while applications that rely exclusively on the stable OIDC sub claim are not affected by that downstream consequence. This issue is fixed in version 2.12.0."}],"id":"CVE-2026-115770","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-115770","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:57:41.783368Z","version":"2.0.3"}}]},"published":"2026-11-04T23:17:18.767","references":[{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/commit/43aaccd5bfacb76283b11ce039fb3f0716196fcb"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/pull/1625"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/releases/tag/v2.12.0"},{"source":"security-advisories@github.com","url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-rm8c-2cv8-jwf6"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/pocket-id/pocket-id/security/advisories/GHSA-rm8c-2cv8-jwf6"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-115819.json b/data/2026/CVE-2026-115819.json index 0dd82a4ee7..2f032d99fb 100644 --- a/data/2026/CVE-2026-115819.json +++ b/data/2026/CVE-2026-115819.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.2","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-115819","lastModified":"2026-11-11T16:17:24.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.980","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34989"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.44","status":"affected","version":"2.2","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.\n\nThese conversions store each wide input character into the caller's char array as a multibyte sequence. The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte. A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end. The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process. An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.\n\nThe narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon. This issue affects all architectures and ABIs supported by the GNU C Library."}],"id":"CVE-2026-115819","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]},"published":"2026-11-11T16:17:24.980","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=34989"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0027"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116303.json b/data/2026/CVE-2026-116303.json index cc054eb53c..5f083b916a 100644 --- a/data/2026/CVE-2026-116303.json +++ b/data/2026/CVE-2026-116303.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116303","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:37.910","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116303/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116303","lastModified":"2026-11-12T22:18:25.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116303","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:31:55.090439Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:37.910","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116303/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116304.json b/data/2026/CVE-2026-116304.json index 88d7d46ff7..fc97cd49e7 100644 --- a/data/2026/CVE-2026-116304.json +++ b/data/2026/CVE-2026-116304.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116304","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116304/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116304","lastModified":"2026-11-12T22:18:25.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116304","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:30:02.358407Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:38.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116304/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116306.json b/data/2026/CVE-2026-116306.json index cb363c3221..eaf2b9c64f 100644 --- a/data/2026/CVE-2026-116306.json +++ b/data/2026/CVE-2026-116306.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116306","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116306/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116306","lastModified":"2026-11-12T22:18:25.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:27:29.041137Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:38.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116306/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116307.json b/data/2026/CVE-2026-116307.json index ac843d952d..9a6783960c 100644 --- a/data/2026/CVE-2026-116307.json +++ b/data/2026/CVE-2026-116307.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116307","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.340","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116307/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116307","lastModified":"2026-11-12T22:18:25.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116307","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:25:48.798686Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:38.340","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116307/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116308.json b/data/2026/CVE-2026-116308.json index 92b6a96778..11c991b32a 100644 --- a/data/2026/CVE-2026-116308.json +++ b/data/2026/CVE-2026-116308.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116308","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.490","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116308/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116308","lastModified":"2026-11-12T22:18:25.840","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116308","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:32:03.345169Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:38.490","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116308/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116309.json b/data/2026/CVE-2026-116309.json index 592ed368b9..d0fa5b183b 100644 --- a/data/2026/CVE-2026-116309.json +++ b/data/2026/CVE-2026-116309.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116309","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:38.647","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116309/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116309","lastModified":"2026-11-12T22:18:26.017","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:26:35.732717Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:38.647","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116309/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116313.json b/data/2026/CVE-2026-116313.json index 9628912a59..247e11971a 100644 --- a/data/2026/CVE-2026-116313.json +++ b/data/2026/CVE-2026-116313.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116313","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.347","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116313/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116313","lastModified":"2026-11-12T22:18:26.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:31:42.181421Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:39.347","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116313/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-426"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116314.json b/data/2026/CVE-2026-116314.json index cf96cbf493..2138d70a9d 100644 --- a/data/2026/CVE-2026-116314.json +++ b/data/2026/CVE-2026-116314.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116314","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.500","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116314/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116314","lastModified":"2026-11-12T22:18:26.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116314","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:30:50.638894Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:39.500","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116314/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116315.json b/data/2026/CVE-2026-116315.json index 6c2fded913..b568c93898 100644 --- a/data/2026/CVE-2026-116315.json +++ b/data/2026/CVE-2026-116315.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116315","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116315/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116315","lastModified":"2026-11-12T22:18:26.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116315","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:29:25.601234Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:39.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116315/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116316.json b/data/2026/CVE-2026-116316.json index 9ddde7db01..6b90afb750 100644 --- a/data/2026/CVE-2026-116316.json +++ b/data/2026/CVE-2026-116316.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116316","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.837","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116316/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116316","lastModified":"2026-11-12T22:18:26.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116316","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:32:46.052709Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:39.837","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116316/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116317.json b/data/2026/CVE-2026-116317.json index aa4c820415..d5d0353546 100644 --- a/data/2026/CVE-2026-116317.json +++ b/data/2026/CVE-2026-116317.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116317","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:39.993","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116317/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116317","lastModified":"2026-11-12T22:18:26.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116317","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:28:21.367030Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:39.993","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116317/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116318.json b/data/2026/CVE-2026-116318.json index fbd461a0ab..cac5fa30c8 100644 --- a/data/2026/CVE-2026-116318.json +++ b/data/2026/CVE-2026-116318.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116318","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.147","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116318/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116318","lastModified":"2026-11-12T22:18:26.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116318","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:26:50.414290Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.147","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116318/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116319.json b/data/2026/CVE-2026-116319.json index 873d746971..677973d5ed 100644 --- a/data/2026/CVE-2026-116319.json +++ b/data/2026/CVE-2026-116319.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116319","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116319/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116319","lastModified":"2026-11-12T22:18:27.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116319","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:23:27.882859Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.313","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116319/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116320.json b/data/2026/CVE-2026-116320.json index cfd34d5cb9..20534be1db 100644 --- a/data/2026/CVE-2026-116320.json +++ b/data/2026/CVE-2026-116320.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116320","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.430","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116320/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116320","lastModified":"2026-11-12T22:18:27.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116320","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:22:40.537286Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.430","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116320/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116321.json b/data/2026/CVE-2026-116321.json index b96143622f..1b238eaea2 100644 --- a/data/2026/CVE-2026-116321.json +++ b/data/2026/CVE-2026-116321.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116321","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.577","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116321/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-170"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116321","lastModified":"2026-11-12T22:18:27.337","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:22:08.348477Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.577","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116321/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-170"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116322.json b/data/2026/CVE-2026-116322.json index 867ad5ad03..be47328b22 100644 --- a/data/2026/CVE-2026-116322.json +++ b/data/2026/CVE-2026-116322.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116322","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:40.707","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116322/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-116322","lastModified":"2026-11-12T22:18:27.497","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116322","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:21:48.203823Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:40.707","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116322/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116331.json b/data/2026/CVE-2026-116331.json index 376d4739c9..9dc8d41056 100644 --- a/data/2026/CVE-2026-116331.json +++ b/data/2026/CVE-2026-116331.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116331","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116331/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116331","lastModified":"2026-11-12T22:18:27.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116331","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:20:43.249137Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.683","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116331/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116332.json b/data/2026/CVE-2026-116332.json index 997877eccb..8bacee96f5 100644 --- a/data/2026/CVE-2026-116332.json +++ b/data/2026/CVE-2026-116332.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116332","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.800","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116332/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116332","lastModified":"2026-11-12T22:18:27.787","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116332","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:20:05.366189Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.800","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116332/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116333.json b/data/2026/CVE-2026-116333.json index f22c523e23..daf3ff1564 100644 --- a/data/2026/CVE-2026-116333.json +++ b/data/2026/CVE-2026-116333.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116333","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:41.920","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116333/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-116333","lastModified":"2026-11-12T22:18:27.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116333","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:19:33.982665Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:41.920","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116333/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-126"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116335.json b/data/2026/CVE-2026-116335.json index 67f4f27c60..f72608c754 100644 --- a/data/2026/CVE-2026-116335.json +++ b/data/2026/CVE-2026-116335.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116335","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116335/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116335","lastModified":"2026-11-12T22:18:28.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:18:59.754936Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.043","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116335/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116336.json b/data/2026/CVE-2026-116336.json index 4625d85c31..cbfadcaf38 100644 --- a/data/2026/CVE-2026-116336.json +++ b/data/2026/CVE-2026-116336.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116336","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.167","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116336/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-116336","lastModified":"2026-11-12T22:18:28.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116336","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:18:26.834780Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.167","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-116336/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-672"},{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116337.json b/data/2026/CVE-2026-116337.json index e8499ba120..7f221770ee 100644 --- a/data/2026/CVE-2026-116337.json +++ b/data/2026/CVE-2026-116337.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"python"},{"lessThan":"6.8.10","status":"affected","version":"4.5.0","versionType":"python"},{"lessThan":"6.12.1","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module."}],"id":"CVE-2026-116337","lastModified":"2026-11-12T19:16:47.380","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.6,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116337","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:12:22.055259Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:58.450","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774223"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774266"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-116337:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*","cpe:2.3:a:qt:qtbase:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["qtbase"],"product":"Qt Framework","vendor":"qt","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"python"},{"lessThan":"6.8.10","status":"affected","version":"4.5.0","versionType":"python"},{"lessThan":"6.12.1","status":"affected","version":"6.9.0","versionType":"python"}]}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt Network module."}],"id":"CVE-2026-116337","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":0.6,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116337","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:12:22.055259Z","version":"2.0.3"}}]},"published":"2026-11-09T09:16:58.450","references":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774223"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://codereview.qt-project.org/c/qt/qtbase/+/774266"},{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-116337:"}],"sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116376.json b/data/2026/CVE-2026-116376.json index 7d763414b4..b7403ba077 100644 --- a/data/2026/CVE-2026-116376.json +++ b/data/2026/CVE-2026-116376.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability."}],"id":"CVE-2026-116376","lastModified":"2026-11-08T02:16:36.030","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:42:17.916635Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:52.680","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*"],"product":"Db2 Genius Hub","vendor":"IBM","versions":[{"status":"affected","version":"1.1.2"},{"status":"affected","version":"1.1.3"},{"status":"affected","version":"1.1.4"},{"status":"affected","version":"1.1.5"}]}],"source":"psirt@us.ibm.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:agentics:1.0:*:*:*:*:*:*:*","matchCriteriaId":"37123C5E-D6EC-4392-8951-6D7C756A9637","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"72E08037-976A-4833-BBFE-8DBEC0202022","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.3:*:*:*:*:*:*:*","matchCriteriaId":"CA404518-FCFB-4D37-A3E8-F8B588B41BBC","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.4:*:*:*:*:*:*:*","matchCriteriaId":"F0848591-988A-458A-ACA7-C7777C9FC418","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:db2_genius_hub:1.1.5:*:*:*:*:*:*:*","matchCriteriaId":"EF3005E4-0EC0-4C4C-8002-775944F8EE13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability."}],"id":"CVE-2026-116376","lastModified":"2026-11-12T21:39:31.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.4,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116376","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-08T01:42:17.916635Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:52.680","references":[{"source":"psirt@us.ibm.com","tags":["Vendor Advisory"],"url":"https://www.ibm.com/support/pages/node/7295187"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116633.json b/data/2026/CVE-2026-116633.json index ed9eb03c0d..fd5f636ec3 100644 --- a/data/2026/CVE-2026-116633.json +++ b/data/2026/CVE-2026-116633.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Idea Tab Pro TB373FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.107","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab One TB305FU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.324","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab One TB305XU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.318","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab Plus TB351FU","vendor":"Lenovo","versions":[{"lessThan":"TBD","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Yoga Tab Plus TB520FU","vendor":"Lenovo","versions":[{"lessThan":"18.5.10.037","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Legion Tab 8.8 TB321FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.319","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case TB311FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.36.508","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case TB311XU","vendor":"Lenovo","versions":[{"lessThan":"17.5.37.529","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab K9 TB305FU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.324","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab K9 TB305XU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.318","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 TB336FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.348","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Idea Tab/ Tab K11 Gen 2 TB336ZU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.443","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Yoga Tab TB710FU","vendor":"Lenovo","versions":[{"lessThan":"1.5.04.519","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges."}],"id":"CVE-2026-116633","lastModified":"2026-11-11T17:17:16.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T17:17:16.180","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/product_security/LEN-220237"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-926"}],"source":"psirt@lenovo.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Idea Tab Pro TB373FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.107","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab One TB305FU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.324","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab One TB305XU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.318","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab Plus TB351FU","vendor":"Lenovo","versions":[{"lessThan":"TBD","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Yoga Tab Plus TB520FU","vendor":"Lenovo","versions":[{"lessThan":"18.5.10.037","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Legion Tab 8.8 TB321FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.319","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case TB311FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.36.508","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab with Clear Case/ Lenovo Tab with Folio Case TB311XU","vendor":"Lenovo","versions":[{"lessThan":"17.5.37.529","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab K9 TB305FU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.324","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Tab K9 TB305XU","vendor":"Lenovo","versions":[{"lessThan":"17.0.10.318","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Lenovo Idea Tab/ Lenovo Tab K11 Gen 2 TB336FU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.348","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Idea Tab/ Tab K11 Gen 2 TB336ZU","vendor":"Lenovo","versions":[{"lessThan":"17.5.10.443","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"Yoga Tab TB710FU","vendor":"Lenovo","versions":[{"lessThan":"1.5.04.519","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges."}],"id":"CVE-2026-116633","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T17:17:16.180","references":[{"source":"psirt@lenovo.com","url":"https://support.lenovo.com/us/en/product_security/LEN-220237"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-926"}],"source":"psirt@lenovo.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116650.json b/data/2026/CVE-2026-116650.json index 78a22f2870..f18f40b267 100644 --- a/data/2026/CVE-2026-116650.json +++ b/data/2026/CVE-2026-116650.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an unauthorized code execution vulnerability in Threat Response."}],"id":"CVE-2026-116650","lastModified":"2026-11-06T20:17:11.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116650","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:17:23.134717Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:30.723","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-095"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"31330110-FFC7-475E-865D-C65E8C6EF5CF","versionEndExcluding":"4.9.480","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"1C59190A-E042-4917-A444-65BF78369F74","versionEndExcluding":"4.12.353","versionStartIncluding":"4.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"0C5F258D-AB67-4587-865C-34D8F9793E02","versionEndExcluding":"4.17.333","versionStartIncluding":"4.17.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an unauthorized code execution vulnerability in Threat Response."}],"id":"CVE-2026-116650","lastModified":"2026-11-12T22:00:36.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116650","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:17:23.134717Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:30.723","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-095"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116651.json b/data/2026/CVE-2026-116651.json index 304ac9a36b..5ea2e8caaa 100644 --- a/data/2026/CVE-2026-116651.json +++ b/data/2026/CVE-2026-116651.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an unauthorized code execution vulnerability in Threat Response."}],"id":"CVE-2026-116651","lastModified":"2026-11-06T20:17:12.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:25:09.136521Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:30.887","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-088"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"31330110-FFC7-475E-865D-C65E8C6EF5CF","versionEndExcluding":"4.9.480","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"1C59190A-E042-4917-A444-65BF78369F74","versionEndExcluding":"4.12.353","versionStartIncluding":"4.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"0C5F258D-AB67-4587-865C-34D8F9793E02","versionEndExcluding":"4.17.333","versionStartIncluding":"4.17.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an unauthorized code execution vulnerability in Threat Response."}],"id":"CVE-2026-116651","lastModified":"2026-11-12T21:54:47.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:25:09.136521Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:30.887","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-088"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116652.json b/data/2026/CVE-2026-116652.json index 161d707c42..481d841b78 100644 --- a/data/2026/CVE-2026-116652.json +++ b/data/2026/CVE-2026-116652.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed a business logic error in Threat Response."}],"id":"CVE-2026-116652","lastModified":"2026-11-06T20:17:12.187","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:22:27.021630Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.033","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-081"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-628"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"31330110-FFC7-475E-865D-C65E8C6EF5CF","versionEndExcluding":"4.9.480","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"1C59190A-E042-4917-A444-65BF78369F74","versionEndExcluding":"4.12.353","versionStartIncluding":"4.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"0C5F258D-AB67-4587-865C-34D8F9793E02","versionEndExcluding":"4.17.333","versionStartIncluding":"4.17.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed a business logic error in Threat Response."}],"id":"CVE-2026-116652","lastModified":"2026-11-12T21:50:22.107","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:22:27.021630Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.033","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-081"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-628"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116653.json b/data/2026/CVE-2026-116653.json index d4c01ce847..231d358fa7 100644 --- a/data/2026/CVE-2026-116653.json +++ b/data/2026/CVE-2026-116653.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper input validation vulnerability in Threat Response."}],"id":"CVE-2026-116653","lastModified":"2026-11-06T20:17:12.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116653","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:24:42.491419Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.190","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-090"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"31330110-FFC7-475E-865D-C65E8C6EF5CF","versionEndExcluding":"4.9.480","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"1C59190A-E042-4917-A444-65BF78369F74","versionEndExcluding":"4.12.353","versionStartIncluding":"4.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"0C5F258D-AB67-4587-865C-34D8F9793E02","versionEndExcluding":"4.17.333","versionStartIncluding":"4.17.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper input validation vulnerability in Threat Response."}],"id":"CVE-2026-116653","lastModified":"2026-11-12T21:48:24.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116653","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:24:42.491419Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.190","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-090"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116654.json b/data/2026/CVE-2026-116654.json index c150686e08..a7e432dc47 100644 --- a/data/2026/CVE-2026-116654.json +++ b/data/2026/CVE-2026-116654.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper input validation vulnerability in Threat Response."}],"id":"CVE-2026-116654","lastModified":"2026-11-06T20:17:12.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116654","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:26:14.106206Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.347","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-083"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Threat Response","vendor":"Tanium","versions":[{"lessThan":"4.9.480","status":"affected","version":"4.9","versionType":"custom"},{"lessThan":"4.12.353","status":"affected","version":"4.12","versionType":"custom"},{"lessThan":"4.17.333","status":"affected","version":"4.17","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"0089B0CA-D2E1-4AAA-B912-AE4E72FB54D3","versionEndExcluding":"4.9.476","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"9AC899EC-328E-42F9-80BC-3CC81A2A6BD0","versionEndExcluding":"4.12.349","versionStartIncluding":"4.12.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:threat_response:*:*:*:*:*:*:*:*","matchCriteriaId":"EA4E5D97-8287-42AD-90B5-88AF0E86A978","versionEndExcluding":"4.17.327","versionStartIncluding":"4.17.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper input validation vulnerability in Threat Response."}],"id":"CVE-2026-116654","lastModified":"2026-11-12T21:45:35.843","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116654","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:26:14.106206Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.347","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-083"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116663.json b/data/2026/CVE-2026-116663.json index 69ee9598d4..725b2aae0d 100644 --- a/data/2026/CVE-2026-116663.json +++ b/data/2026/CVE-2026-116663.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Enforce","vendor":"Tanium","versions":[{"lessThan":"3.0.373","status":"affected","version":"3.0.0","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper access controls vulnerability in Enforce."}],"id":"CVE-2026-116663","lastModified":"2026-11-06T20:17:12.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:18:03.811384Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.647","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","url":"https://security.tanium.com/TAN-2026-099"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Undergoing Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Enforce","vendor":"Tanium","versions":[{"lessThan":"3.0.373","status":"affected","version":"3.0.0","versionType":"custom"}]}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tanium:enforce:*:*:*:*:*:*:*:*","matchCriteriaId":"F5C37D52-E28B-4BD8-BDAF-029D8DE19B02","versionEndExcluding":"2.9.736","versionStartIncluding":"2.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:enforce:*:*:*:*:*:*:*:*","matchCriteriaId":"291D1D2D-BDFC-4D16-8E82-AEF523064CA4","versionEndExcluding":"2.10.778","versionStartIncluding":"2.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:tanium:enforce:*:*:*:*:*:*:*:*","matchCriteriaId":"1AE74C7F-D50B-4FCB-A41B-C17F35DDDF59","versionEndExcluding":"3.0.373","versionStartIncluding":"3.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tanium addressed an improper access controls vulnerability in Enforce."}],"id":"CVE-2026-116663","lastModified":"2026-11-12T21:43:16.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:18:03.811384Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:31.647","references":[{"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","tags":["Vendor Advisory"],"url":"https://security.tanium.com/TAN-2026-099"}],"sourceIdentifier":"3938794e-25f5-4123-a1ba-5cbd7f104512","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"3938794e-25f5-4123-a1ba-5cbd7f104512","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-116845.json b/data/2026/CVE-2026-116845.json index b9795dda2e..745b321394 100644 --- a/data/2026/CVE-2026-116845.json +++ b/data/2026/CVE-2026-116845.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/netbox-community/netbox","product":"netbox","vendor":"netbox-community","versions":[{"lessThan":"4.7.4","status":"affected","version":"2.9.0","versionType":"semver"},{"status":"unaffected","version":"4.7.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them."}],"id":"CVE-2026-116845","lastModified":"2026-11-03T20:18:11.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116845","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T19:35:14.116793Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:54.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/issues/23467"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/pull/23468"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/releases/tag/v4.7.4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/netbox-community/netbox/issues/23467"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/netbox-community/netbox","product":"netbox","vendor":"netbox-community","versions":[{"lessThan":"4.7.4","status":"affected","version":"2.9.0","versionType":"semver"},{"status":"unaffected","version":"4.7.4","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them."}],"id":"CVE-2026-116845","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-116845","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T19:35:14.116793Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:54.530","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/issues/23467"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/pull/23468"},{"source":"disclosure@vulncheck.com","url":"https://github.com/netbox-community/netbox/releases/tag/v4.7.4"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/netbox-community/netbox/issues/23467"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117373.json b/data/2026/CVE-2026-117373.json index b1a68f4ffc..50d7c79877 100644 --- a/data/2026/CVE-2026-117373.json +++ b/data/2026/CVE-2026-117373.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio."}],"id":"CVE-2026-117373","lastModified":"2026-11-11T18:19:09.483","metrics":{},"published":"2026-11-11T18:19:09.483","references":[{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/pull/3637"},{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/pull/3676"},{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/releases/tag/v1.4.2"},{"source":"cve@mitre.org","url":"https://github.com/w1n0y/CVE"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio."}],"id":"CVE-2026-117373","lastModified":"2026-11-12T22:11:01.153","metrics":{},"published":"2026-11-11T18:19:09.483","references":[{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/pull/3637"},{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/pull/3676"},{"source":"cve@mitre.org","url":"https://github.com/meetecho/janus-gateway/releases/tag/v1.4.2"},{"source":"cve@mitre.org","url":"https://github.com/w1n0y/CVE"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Deferred"} diff --git a/data/2026/CVE-2026-117542.json b/data/2026/CVE-2026-117542.json index 68c6b67144..054f811ae0 100644 --- a/data/2026/CVE-2026-117542.json +++ b/data/2026/CVE-2026-117542.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations."}],"id":"CVE-2026-117542","lastModified":"2026-11-12T19:16:47.740","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:47.740","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-35"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations."}],"id":"CVE-2026-117542","lastModified":"2026-11-12T22:18:32.630","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:33:31.069534Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:47.740","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-35"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117543.json b/data/2026/CVE-2026-117543.json index 1de92df3f2..5c1e5b7453 100644 --- a/data/2026/CVE-2026-117543.json +++ b/data/2026/CVE-2026-117543.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF)."}],"id":"CVE-2026-117543","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.503","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF)."}],"id":"CVE-2026-117543","lastModified":"2026-11-12T22:18:32.800","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:35:19.472452Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:15.503","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117544.json b/data/2026/CVE-2026-117544.json index 9c76feb89b..aae7224a25 100644 --- a/data/2026/CVE-2026-117544.json +++ b/data/2026/CVE-2026-117544.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download."}],"id":"CVE-2026-117544","lastModified":"2026-11-12T19:16:47.883","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:47.883","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download."}],"id":"CVE-2026-117544","lastModified":"2026-11-12T22:18:32.957","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:33:24.480073Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:47.883","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117550.json b/data/2026/CVE-2026-117550.json index b0184c6f43..509cb2bf0c 100644 --- a/data/2026/CVE-2026-117550.json +++ b/data/2026/CVE-2026-117550.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy."}],"id":"CVE-2026-117550","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.657","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy."}],"id":"CVE-2026-117550","lastModified":"2026-11-12T22:18:33.107","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117550","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:35:06.669204Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:15.657","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-117551.json b/data/2026/CVE-2026-117551.json index c8a1379d4d..172aacc03b 100644 --- a/data/2026/CVE-2026-117551.json +++ b/data/2026/CVE-2026-117551.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution."}],"id":"CVE-2026-117551","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"ATTACKED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:15.813","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution."}],"id":"CVE-2026-117551","lastModified":"2026-11-12T22:18:33.260","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"ATTACKED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-117551","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:34:06.510346Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:15.813","references":[{"source":"security@joomla.org","url":"https://www.jdownloads.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118208.json b/data/2026/CVE-2026-118208.json index 59af13e84b..4f15868bb9 100644 --- a/data/2026/CVE-2026-118208.json +++ b/data/2026/CVE-2026-118208.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.057","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network."}],"id":"CVE-2026-118208","lastModified":"2026-11-12T20:18:17.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:44:20.970413Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:37.800","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.057","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network."}],"id":"CVE-2026-118208","lastModified":"2026-11-12T22:18:37.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:44:20.970413Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:37.800","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-15"}],"source":"secure@microsoft.com","type":"Primary"},{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118237.json b/data/2026/CVE-2026-118237.json index 0c753485a8..ac4597771e 100644 --- a/data/2026/CVE-2026-118237.json +++ b/data/2026/CVE-2026-118237.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-118237","lastModified":"2026-11-06T19:17:38.290","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:19.422642Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:33.217","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"product-cna@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.19.14","status":"unaffected"}],"lessThan":"3.19.*","status":"affected","version":"3.19.0","versionType":"semver"},{"changes":[{"at":"3.20.10","status":"unaffected"}],"lessThan":"3.20.*","status":"affected","version":"3.20.0","versionType":"semver"},{"changes":[{"at":"3.21.8","status":"unaffected"}],"lessThan":"3.21.*","status":"affected","version":"3.21.0","versionType":"semver"},{"changes":[{"at":"3.22.3","status":"unaffected"}],"lessThan":"3.22.*","status":"affected","version":"3.22.0","versionType":"semver"}]}],"source":"product-cna@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program."}],"id":"CVE-2026-118237","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"product-cna@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118237","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:09:19.422642Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:33.217","references":[{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8"},{"source":"product-cna@github.com","url":"https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3"}],"sourceIdentifier":"product-cna@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"product-cna@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-118904.json b/data/2026/CVE-2026-118904.json index 9a96171c57..d4dfef9da7 100644 --- a/data/2026/CVE-2026-118904.json +++ b/data/2026/CVE-2026-118904.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:webmethods_integration_server:12.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:webmethods_integration_server:12.1.0:*:*:*:*:*:*:*"],"product":"webMethods Integration Server","vendor":"IBM","versions":[{"status":"affected","version":"12.1"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication."}],"id":"CVE-2026-118904","lastModified":"2026-11-08T20:17:24.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T20:17:23.980","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295306"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:webmethods_integration_server:12.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:webmethods_integration_server:12.1.0:*:*:*:*:*:*:*"],"product":"webMethods Integration Server","vendor":"IBM","versions":[{"status":"affected","version":"12.1"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication."}],"id":"CVE-2026-118904","lastModified":"2026-11-12T21:17:20.327","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-118904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:08:17.129444Z","version":"2.0.3"}}]},"published":"2026-11-08T20:17:23.980","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295306"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119055.json b/data/2026/CVE-2026-119055.json index 40c3b124c4..4dbae7afd6 100644 --- a/data/2026/CVE-2026-119055.json +++ b/data/2026/CVE-2026-119055.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EcoStruxure™ Power Build Rapsody","vendor":"Schneider Electric","versions":[{"status":"affected","version":"FR-V2.9.1.0 and prior"},{"status":"affected","version":"ESP-V2.8.5.0301 and prior"},{"status":"affected","version":"PT-V2.8.7.0101 and prior"},{"status":"affected","version":"BEL(FR)-V2.8.8.0201 and prior"},{"status":"affected","version":"BEL(EN)-V2.8.3.0201 and prior"},{"status":"affected","version":"INT(EN)-V2.8.4.0401 and prior"},{"status":"affected","version":"INT(FR)-V2.8.6.0000 and prior"},{"status":"affected","version":"NL-V2.8.2.0000 and prior"}]}],"source":"cybersecurity@se.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to open a specially crafted malicious SSD file."}],"id":"CVE-2026-119055","lastModified":"2026-11-11T19:17:30.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cybersecurity@se.com","type":"Secondary"}]},"published":"2026-11-11T19:17:30.153","references":[{"source":"cybersecurity@se.com","url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-314-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-314-01.pdf"}],"sourceIdentifier":"cybersecurity@se.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cybersecurity@se.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"EcoStruxure™ Power Build Rapsody","vendor":"Schneider Electric","versions":[{"status":"affected","version":"FR-V2.9.1.0 and prior"},{"status":"affected","version":"ESP-V2.8.5.0301 and prior"},{"status":"affected","version":"PT-V2.8.7.0101 and prior"},{"status":"affected","version":"BEL(FR)-V2.8.8.0201 and prior"},{"status":"affected","version":"BEL(EN)-V2.8.3.0201 and prior"},{"status":"affected","version":"INT(EN)-V2.8.4.0401 and prior"},{"status":"affected","version":"INT(FR)-V2.8.6.0000 and prior"},{"status":"affected","version":"NL-V2.8.2.0000 and prior"}]}],"source":"cybersecurity@se.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to open a specially crafted malicious SSD file."}],"id":"CVE-2026-119055","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cybersecurity@se.com","type":"Secondary"}]},"published":"2026-11-11T19:17:30.153","references":[{"source":"cybersecurity@se.com","url":"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-314-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-314-01.pdf"}],"sourceIdentifier":"cybersecurity@se.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"cybersecurity@se.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119238.json b/data/2026/CVE-2026-119238.json index 8e6b2926f5..a740b14c6d 100644 --- a/data/2026/CVE-2026-119238.json +++ b/data/2026/CVE-2026-119238.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XiangBangbang Application","vendor":"Lenovo","versions":[{"lessThan":"1.0.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthorized touch gestures."}],"id":"CVE-2026-119238","lastModified":"2026-11-11T17:17:17.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T17:17:17.057","references":[{"source":"psirt@lenovo.com","url":"https://iknow.lenovo.com.cn/detail/443047"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-926"}],"source":"psirt@lenovo.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"XiangBangbang Application","vendor":"Lenovo","versions":[{"lessThan":"1.0.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"psirt@lenovo.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthorized touch gestures."}],"id":"CVE-2026-119238","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"psirt@lenovo.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"psirt@lenovo.com","type":"Secondary"}]},"published":"2026-11-11T17:17:17.057","references":[{"source":"psirt@lenovo.com","url":"https://iknow.lenovo.com.cn/detail/443047"}],"sourceIdentifier":"psirt@lenovo.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-926"}],"source":"psirt@lenovo.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119274.json b/data/2026/CVE-2026-119274.json index 702d984dab..9e6b1c0746 100644 --- a/data/2026/CVE-2026-119274.json +++ b/data/2026/CVE-2026-119274.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"NIOS","vendor":"Infoblox","versions":[{"lessThan":"9.1.0","status":"affected","version":"9.0.x","versionType":"custom"}]}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS"}],"id":"CVE-2026-119274","lastModified":"2026-11-12T17:17:27.003","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:18:37.808188Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:06.400","references":[{"source":"f84ca5ce-fbe7-4668-8724-994599108a02","url":"https://infoblox.com/"}],"sourceIdentifier":"f84ca5ce-fbe7-4668-8724-994599108a02","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"NIOS","vendor":"Infoblox","versions":[{"lessThan":"9.1.0","status":"affected","version":"9.0.x","versionType":"custom"}]}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS"}],"id":"CVE-2026-119274","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119274","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T16:18:37.808188Z","version":"2.0.3"}}]},"published":"2026-11-09T14:17:06.400","references":[{"source":"f84ca5ce-fbe7-4668-8724-994599108a02","url":"https://infoblox.com/"}],"sourceIdentifier":"f84ca5ce-fbe7-4668-8724-994599108a02","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"f84ca5ce-fbe7-4668-8724-994599108a02","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119344.json b/data/2026/CVE-2026-119344.json index 5e2c55c245..d131253c37 100644 --- a/data/2026/CVE-2026-119344.json +++ b/data/2026/CVE-2026-119344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"cocos","vendor":"ultravioletrs","versions":[{"status":"affected","version":"<= 0.8.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself."}],"id":"CVE-2026-119344","lastModified":"2026-11-09T23:17:13.407","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119344","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:13:47.467673Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.373","references":[{"source":"security-advisories@github.com","url":"https://dl.acm.org/doi/10.1145/3779208.3785387"},{"source":"security-advisories@github.com","url":"https://doi.org/10.1145/3779208.3785387"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/security/advisories/GHSA-v5m8-5wxc-vjgp"},{"source":"security-advisories@github.com","url":"https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/platform-ownership-endorsements.html"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"cocos","vendor":"ultravioletrs","versions":[{"status":"affected","version":"<= 0.8.2"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique machine identity and without enforcing revocation. A remote attacker who controls or compromises another platform trusted by the same verifier can substitute valid Evidence from that platform and cause authorization of the wrong platform. This vulnerability is addressed in 0.9.0. However, this vulnerability can't be patched in source code alone, since the vulnerability arises from the confidential computing threat model itself."}],"id":"CVE-2026-119344","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119344","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:13:47.467673Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.373","references":[{"source":"security-advisories@github.com","url":"https://dl.acm.org/doi/10.1145/3779208.3785387"},{"source":"security-advisories@github.com","url":"https://doi.org/10.1145/3779208.3785387"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/security/advisories/GHSA-v5m8-5wxc-vjgp"},{"source":"security-advisories@github.com","url":"https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/platform-ownership-endorsements.html"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-346"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119345.json b/data/2026/CVE-2026-119345.json index f3e98d6173..44af8a4864 100644 --- a/data/2026/CVE-2026-119345.json +++ b/data/2026/CVE-2026-119345.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"cocos","vendor":"ultravioletrs","versions":[{"status":"affected","version":"< 0.9.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0."}],"id":"CVE-2026-119345","lastModified":"2026-11-05T21:18:40.920","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:40:34.478750Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.553","references":[{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/commit/80bf813c48300f02259b338b91f844c71be582ea"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/pull/582"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/security/advisories/GHSA-ghwv-vrp2-2975"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"cocos","vendor":"ultravioletrs","versions":[{"status":"affected","version":"< 0.9.0"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attached devices after that check can keep the existing connection open while the peer continues trusting stale initial Evidence. This gap is especially significant for long-lived connections because the verifier has no mechanism to detect the changed state. This issue is fixed in version 0.9.0."}],"id":"CVE-2026-119345","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119345","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:40:34.478750Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.553","references":[{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/commit/80bf813c48300f02259b338b91f844c71be582ea"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/pull/582"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0"},{"source":"security-advisories@github.com","url":"https://github.com/ultravioletrs/cocos/security/advisories/GHSA-ghwv-vrp2-2975"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119618.json b/data/2026/CVE-2026-119618.json index 94c1db98c2..87b3b37660 100644 --- a/data/2026/CVE-2026-119618.json +++ b/data/2026/CVE-2026-119618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-12T17:06:26.857","metrics":{},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"2.4.70","status":"affected","version":"2.4.55","versionType":"semver"}]}],"source":"security@apache.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}],"id":"CVE-2026-119618","lastModified":"2026-11-12T21:17:20.893","metrics":{},"published":"2026-11-11T15:17:15.900","references":[{"source":"security@apache.org","url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/11/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/security/cve/cve-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://bugs.gentoo.org/986161"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/AlmaLinux/updates/issues/4252"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/microsoft/azurelinux/pull/20165"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://ubuntu.com/security/CVE-2026-119618"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"security@apache.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119743.json b/data/2026/CVE-2026-119743.json index dc44ddc91e..a5016cf88c 100644 --- a/data/2026/CVE-2026-119743.json +++ b/data/2026/CVE-2026-119743.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/pdfmake","product":"pdfmake","repo":"https://github.com/bpampuch/pdfmake","vendor":"bpampuch","versions":[{"lessThan":"0.3.14","status":"affected","version":"0.3.0-beta.1","versionType":"semver"},{"lessThan":"0.2.23","status":"unaffected","version":"0.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy."}],"id":"CVE-2026-119743","lastModified":"2026-11-09T14:17:06.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T14:17:06.573","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/commit/73aaed7a90699f31036a77f957fe3303693e3c8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/pdfmake/docs/commit/e8a6e2b2bf728f457ed65c7a1642db7b8446592e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pdfmake-shared-cache-access-policy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/pdfmake","product":"pdfmake","repo":"https://github.com/bpampuch/pdfmake","vendor":"bpampuch","versions":[{"lessThan":"0.3.14","status":"affected","version":"0.3.0-beta.1","versionType":"semver"},{"lessThan":"0.2.23","status":"unaffected","version":"0.2.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcement. Attackers can retrieve resources fetched with another caller's credentials or from URLs that a later document's access policy would deny, resulting in cross-document information disclosure and bypass of the URL access policy."}],"id":"CVE-2026-119743","lastModified":"2026-11-12T21:35:47.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-09T14:17:06.573","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/commit/73aaed7a90699f31036a77f957fe3303693e3c8f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bpampuch/pdfmake/releases/tag/0.3.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/pdfmake/docs/commit/e8a6e2b2bf728f457ed65c7a1642db7b8446592e"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pdfmake-shared-cache-access-policy-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-524"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119744.json b/data/2026/CVE-2026-119744.json index 89df996383..9984fbc451 100644 --- a/data/2026/CVE-2026-119744.json +++ b/data/2026/CVE-2026-119744.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ThinLinc","vendor":"Cendio","versions":[{"lessThan":"4.15.1","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"4.16.1","status":"affected","version":"4.16.0","versionType":"semver"},{"lessThan":"4.17.1","status":"affected","version":"4.17.0","versionType":"semver"},{"lessThan":"4.18.1","status":"affected","version":"4.18.0","versionType":"semver"},{"lessThan":"4.19.1","status":"affected","version":"4.19.0","versionType":"semver"},{"lessThan":"4.20.1","status":"affected","version":"4.20.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0."}],"id":"CVE-2026-119744","lastModified":"2026-11-05T17:17:56.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:24:14.643454Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:20.557","references":[{"source":"disclosure@vulncheck.com","url":"https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985"},{"source":"disclosure@vulncheck.com","url":"https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"ThinLinc","vendor":"Cendio","versions":[{"lessThan":"4.15.1","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"4.16.1","status":"affected","version":"4.16.0","versionType":"semver"},{"lessThan":"4.17.1","status":"affected","version":"4.17.0","versionType":"semver"},{"lessThan":"4.18.1","status":"affected","version":"4.18.0","versionType":"semver"},{"lessThan":"4.19.1","status":"affected","version":"4.19.0","versionType":"semver"},{"lessThan":"4.20.1","status":"affected","version":"4.20.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0."}],"id":"CVE-2026-119744","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T16:24:14.643454Z","version":"2.0.3"}}]},"published":"2026-11-05T15:17:20.557","references":[{"source":"disclosure@vulncheck.com","url":"https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985"},{"source":"disclosure@vulncheck.com","url":"https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119746.json b/data/2026/CVE-2026-119746.json index 44329ba337..d4aa1ad98f 100644 --- a/data/2026/CVE-2026-119746.json +++ b/data/2026/CVE-2026-119746.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"X35-HWC-A","vendor":"ProSoft Technology","versions":[{"lessThanOrEqual":"1.14.153","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.14.158","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"ICX35-HWC-E","vendor":"ProSoft Technology","versions":[{"lessThanOrEqual":"1.14.153","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.14.158","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."}],"id":"CVE-2026-119746","lastModified":"2026-11-04T19:17:25.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:12:42.577598Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:45.100","references":[{"source":"disclosure@vulncheck.com","url":"https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-602"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"X35-HWC-A","vendor":"ProSoft Technology","versions":[{"lessThanOrEqual":"1.14.153","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.14.158","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"ICX35-HWC-E","vendor":"ProSoft Technology","versions":[{"lessThanOrEqual":"1.14.153","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1.14.158","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."}],"id":"CVE-2026-119746","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:12:42.577598Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:45.100","references":[{"source":"disclosure@vulncheck.com","url":"https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-602"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119747.json b/data/2026/CVE-2026-119747.json index fb237c9c55..f97b22ce3d 100644 --- a/data/2026/CVE-2026-119747.json +++ b/data/2026/CVE-2026-119747.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API."}],"id":"CVE-2026-119747","lastModified":"2026-11-04T21:17:55.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:22:35.412759Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.607","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-incorrect-authorization-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API."}],"id":"CVE-2026-119747","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:22:35.412759Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.607","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-incorrect-authorization-via-rest-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119748.json b/data/2026/CVE-2026-119748.json index d4db375be6..f68e89f2d2 100644 --- a/data/2026/CVE-2026-119748.json +++ b/data/2026/CVE-2026-119748.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold."}],"id":"CVE-2026-119748","lastModified":"2026-11-04T21:17:56.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119748","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:24:43.578506Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.770","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-authorization-bypass-via-maybe-use-invoice"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold."}],"id":"CVE-2026-119748","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119748","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:24:43.578506Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.770","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-authorization-bypass-via-maybe-use-invoice"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119749.json b/data/2026/CVE-2026-119749.json index 613dac8bc0..66eecb8948 100644 --- a/data/2026/CVE-2026-119749.json +++ b/data/2026/CVE-2026-119749.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge."}],"id":"CVE-2026-119749","lastModified":"2026-11-04T21:17:56.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119749","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:26:18.649994Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.930","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Payment forms, Buy now buttons, and Invoicing System | GetPaid","vendor":"AyeCode Ltd","versions":[{"lessThan":"2.8.63","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge."}],"id":"CVE-2026-119749","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119749","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:26:18.649994Z","version":"2.0.3"}}]},"published":"2026-11-04T17:17:34.930","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/invoicing/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/getpaid-wordpress-plugin-negative-quantity-payment-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1284"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119751.json b/data/2026/CVE-2026-119751.json index 9d163eb102..1cedfb7e64 100644 --- a/data/2026/CVE-2026-119751.json +++ b/data/2026/CVE-2026-119751.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Egg – Affiliate Product Importer & Price Comparison","vendor":"keywordrush","versions":[{"lessThanOrEqual":"12.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"12.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions."}],"id":"CVE-2026-119751","lastModified":"2026-11-05T21:18:41.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:41:07.538980Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.717","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/content-egg/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/content-egg-wordpress-plugin-unauthenticated-information-disclosure-via-render-blocks"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Content Egg – Affiliate Product Importer & Price Comparison","vendor":"keywordrush","versions":[{"lessThanOrEqual":"12.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"12.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions."}],"id":"CVE-2026-119751","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119751","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:41:07.538980Z","version":"2.0.3"}}]},"published":"2026-11-05T16:17:40.717","references":[{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/content-egg/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/content-egg-wordpress-plugin-unauthenticated-information-disclosure-via-render-blocks"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119755.json b/data/2026/CVE-2026-119755.json index 14635d8876..3ebcfe1162 100644 --- a/data/2026/CVE-2026-119755.json +++ b/data/2026/CVE-2026-119755.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/arendst/Tasmota","product":"Tasmota","repo":"https://github.com/arendst/Tasmota","vendor":"arendst","versions":[{"lessThanOrEqual":"16.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1cb7ebcafb0b79f1836d0e9948275f78abc17d7b","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword."}],"id":"CVE-2026-119755","lastModified":"2026-11-10T19:19:55.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:01:43.165180Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:22.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f1836d0e9948275f78abc17d7b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/arendst/Tasmota","product":"Tasmota","repo":"https://github.com/arendst/Tasmota","vendor":"arendst","versions":[{"lessThanOrEqual":"16.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"1cb7ebcafb0b79f1836d0e9948275f78abc17d7b","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword."}],"id":"CVE-2026-119755","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119755","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:01:43.165180Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:22.163","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f1836d0e9948275f78abc17d7b"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119756.json b/data/2026/CVE-2026-119756.json index a8083cf8a4..745dfbe2f8 100644 --- a/data/2026/CVE-2026-119756.json +++ b/data/2026/CVE-2026-119756.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/arendst/Tasmota","product":"Tasmota","repo":"https://github.com/arendst/Tasmota","vendor":"arendst","versions":[{"lessThanOrEqual":"16.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"e97e1e4f7e319a55caa1613aef1f25fc81bdb554","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies."}],"id":"CVE-2026-119756","lastModified":"2026-11-09T23:17:13.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119756","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:51:07.350971Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:22.320","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-805"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/arendst/Tasmota","product":"Tasmota","repo":"https://github.com/arendst/Tasmota","vendor":"arendst","versions":[{"lessThanOrEqual":"16.0.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"e97e1e4f7e319a55caa1613aef1f25fc81bdb554","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies."}],"id":"CVE-2026-119756","lastModified":"2026-11-12T20:57:59.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119756","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:51:07.350971Z","version":"2.0.3"}}]},"published":"2026-11-09T18:17:22.320","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/arendst/Tasmota/commit/e97e1e4f7e319a55caa1613aef1f25fc81bdb554"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/tasmota-heap-out-of-bounds-write-via-device-groups-udp"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-805"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119757.json b/data/2026/CVE-2026-119757.json index bcc08df08d..7db7803055 100644 --- a/data/2026/CVE-2026-119757.json +++ b/data/2026/CVE-2026-119757.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/btcpayserver/btcpayserver","product":"BTCPay Server","repo":"https://github.com/btcpayserver/btcpayserver","vendor":"BTCPay Server","versions":[{"lessThan":"2.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments."}],"id":"CVE-2026-119757","lastModified":"2026-11-05T22:17:53.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-05T22:17:53.203","references":[{"source":"disclosure@vulncheck.com","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"source":"disclosure@vulncheck.com","url":"https://www.binance.com/en/square/post/384812445203404"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-552"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/btcpayserver/btcpayserver","product":"BTCPay Server","repo":"https://github.com/btcpayserver/btcpayserver","vendor":"BTCPay Server","versions":[{"lessThan":"2.4.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use the exposed macaroon to gain full control of the LND node, including moving funds, resulting in theft of funds from affected deployments."}],"id":"CVE-2026-119757","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-05T22:17:53.203","references":[{"source":"disclosure@vulncheck.com","url":"https://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/"},{"source":"disclosure@vulncheck.com","url":"https://www.binance.com/en/square/post/384812445203404"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/btcpay-server-lnd-macaroon-credential-file-disclosure"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-522"},{"lang":"en","value":"CWE-552"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119758.json b/data/2026/CVE-2026-119758.json index 1a78b43099..8c420588e6 100644 --- a/data/2026/CVE-2026-119758.json +++ b/data/2026/CVE-2026-119758.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Monogramm/erpnext_ocr","product":"erpnext_ocr","repo":"https://github.com/Monogramm/erpnext_ocr","vendor":"Monogramm","versions":[{"lessThanOrEqual":"1.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe's File doctype permission model and access other users' private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints."}],"id":"CVE-2026-119758","lastModified":"2026-11-06T18:17:58.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119758","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:45:26.436170Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:58.240","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/behruz-svg/a51b0c18510aa0ecc18a6bc6014b0b19"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/erpnext-ocr-path-traversal-and-ssrf-via-read-document"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Monogramm/erpnext_ocr","product":"erpnext_ocr","repo":"https://github.com/Monogramm/erpnext_ocr","vendor":"Monogramm","versions":[{"lessThanOrEqual":"1.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the whitelisted read_document method. Attackers can supply local file paths to bypass Frappe's File doctype permission model and access other users' private uploads, or supply arbitrary URLs to trigger server-side requests reaching internal services and cloud metadata endpoints."}],"id":"CVE-2026-119758","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119758","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T17:45:26.436170Z","version":"2.0.3"}}]},"published":"2026-11-06T18:17:58.240","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/behruz-svg/a51b0c18510aa0ecc18a6bc6014b0b19"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/erpnext-ocr-path-traversal-and-ssrf-via-read-document"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-119759.json b/data/2026/CVE-2026-119759.json index 1aac928ec8..283b7f5fec 100644 --- a/data/2026/CVE-2026-119759.json +++ b/data/2026/CVE-2026-119759.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/trailbaseio/trailbase","product":"trailbase","repo":"https://github.com/trailbaseio/trailbase","vendor":"trailbaseio","versions":[{"lessThan":"0.35.10","status":"affected","version":"0.28.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its stripped file id via a $like filter and then permanently delete or orphan the victim’s file by deleting or nulling a record they own."}],"id":"CVE-2026-119759","lastModified":"2026-11-12T18:17:16.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:05:46.778782Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:28.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/trailbaseio/trailbase/releases#release-v0.35.10"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/trailbase-idor-via-record-api-file-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/trailbaseio/trailbase","product":"trailbase","repo":"https://github.com/trailbaseio/trailbase","vendor":"trailbaseio","versions":[{"lessThan":"0.35.10","status":"affected","version":"0.28.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference in std.FileUpload columns, where the Record API accepts attacker-supplied object-store file ids on insert and update without ownership validation. An authenticated attacker who can read a victim’s row can recover its stripped file id via a $like filter and then permanently delete or orphan the victim’s file by deleting or nulling a record they own."}],"id":"CVE-2026-119759","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119759","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:05:46.778782Z","version":"2.0.3"}}]},"published":"2026-11-09T22:18:28.620","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/trailbaseio/trailbase/releases#release-v0.35.10"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/trailbase-idor-via-record-api-file-column"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119776.json b/data/2026/CVE-2026-119776.json index 4584c817aa..c214cfe78f 100644 --- a/data/2026/CVE-2026-119776.json +++ b/data/2026/CVE-2026-119776.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["ospf6d"],"product":"frrouting","programFiles":["ospf6d/ospf6_message.c"],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"eaccfcdb35bce8d94621b06633417ba3fa657f34","status":"unaffected"}],"lessThan":"*","status":"affected","version":"0","versionType":"git"}]}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.\n\n\nNote the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.\n\n\nRequired configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with \"router ospf6\" and on specific interfaces with \"ipv6 ospf6 area\".)\n\n\nWorkaround: either:\n\n * configure OSPFv3 authentication trailers (\"ipv6 ospf6 authentication\")\n * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses."}],"id":"CVE-2026-119776","lastModified":"2026-11-09T22:18:28.790","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:10:58.734852Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.400","references":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/23935"},{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/24183"},{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/24183/changes/eaccfcdb35bce8d94621b06633417ba3fa657f34"}],"sourceIdentifier":"57a55968-44ac-464c-a794-6ba3baad09c4","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","modules":["ospf6d"],"product":"frrouting","programFiles":["ospf6d/ospf6_message.c"],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"eaccfcdb35bce8d94621b06633417ba3fa657f34","status":"unaffected"}],"lessThan":"*","status":"affected","version":"0","versionType":"git"}]}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.\n\n\nNote the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.\n\n\nRequired configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with \"router ospf6\" and on specific interfaces with \"ipv6 ospf6 area\".)\n\n\nWorkaround: either:\n\n * configure OSPFv3 authentication trailers (\"ipv6 ospf6 authentication\")\n * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses."}],"id":"CVE-2026-119776","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119776","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:10:58.734852Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:41.400","references":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/23935"},{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/24183"},{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/24183/changes/eaccfcdb35bce8d94621b06633417ba3fa657f34"}],"sourceIdentifier":"57a55968-44ac-464c-a794-6ba3baad09c4","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-304"}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119800.json b/data/2026/CVE-2026-119800.json index 578ddc49bd..a29eec65b6 100644 --- a/data/2026/CVE-2026-119800.json +++ b/data/2026/CVE-2026-119800.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ryot","vendor":"IgnisDa","versions":[{"status":"affected","version":"< 10.5.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."}],"id":"CVE-2026-119800","lastModified":"2026-11-09T23:17:14.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:35:16.005330Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/pull/1870"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ryot","vendor":"IgnisDa","versions":[{"status":"affected","version":"< 10.5.6"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."}],"id":"CVE-2026-119800","lastModified":"2026-11-12T22:18:51.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:35:16.005330Z","version":"2.0.3"}}]},"published":"2026-11-06T22:17:50.480","references":[{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/pull/1870"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"security-advisories@github.com","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119832.json b/data/2026/CVE-2026-119832.json index 3555b8e625..650edde0a3 100644 --- a/data/2026/CVE-2026-119832.json +++ b/data/2026/CVE-2026-119832.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack."}],"id":"CVE-2026-119832","lastModified":"2026-11-12T20:18:20.510","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:19:22.565437Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:58.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119832"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"platforms":["32-bit Systems","x64-based Systems"],"product":"Windows 10 Version 1809","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 21H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19044.7846","status":"affected","version":"10.0.19044.0","versionType":"custom"}]},{"platforms":["32-bit Systems","ARM64-based Systems","x64-based Systems"],"product":"Windows 10 Version 22H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.19045.7846","status":"affected","version":"10.0.19045.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems"],"product":"Windows 11 version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows 11 Version 23H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.22631.7711","status":"affected","version":"10.0.22631.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 24H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.9974","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 25H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26200.9974","status":"affected","version":"10.0.26200.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 version 26H1","vendor":"Microsoft","versions":[{"lessThan":"10.0.28000.3501","status":"affected","version":"10.0.28000.0","versionType":"custom"}]},{"platforms":["ARM64-based Systems","x64-based Systems"],"product":"Windows 11 Version 26H2","vendor":"Microsoft","versions":[{"lessThan":"10.0.26300.9974","status":"affected","version":"10.0.26300.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2019 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.17763.9487","status":"affected","version":"10.0.17763.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2022","vendor":"Microsoft","versions":[{"lessThan":"10.0.20348.5870","status":"affected","version":"10.0.20348.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]},{"platforms":["x64-based Systems"],"product":"Windows Server 2025 (Server Core installation)","vendor":"Microsoft","versions":[{"lessThan":"10.0.26100.33822","status":"affected","version":"10.0.26100.0","versionType":"custom"}]}],"source":"secure@microsoft.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature with a physical attack."}],"id":"CVE-2026-119832","lastModified":"2026-11-12T22:18:51.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":0.7,"impactScore":5.2,"source":"secure@microsoft.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T19:19:22.565437Z","version":"2.0.3"}}]},"published":"2026-11-10T19:19:58.670","references":[{"source":"secure@microsoft.com","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119832"}],"sourceIdentifier":"secure@microsoft.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-732"}],"source":"secure@microsoft.com","type":"Primary"},{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120033.json b/data/2026/CVE-2026-120033.json index c38beb92e5..fe3b7e272c 100644 --- a/data/2026/CVE-2026-120033.json +++ b/data/2026/CVE-2026-120033.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_fsm.c"],"programRoutines":[{"name":"bgp_event_stop_with_notify"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","status":"unaffected"}],"lessThan":"*","status":"affected","version":"4967bf6d729d7dd14dff7b672b2fd4afe78a0d86","versionType":"git"}]}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up.\n\n\nA BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can cause one of the following:\n\n * If the neighbor announced Graceful Restart support: bgpd crashes shortly after the session is closed (after the neighbor's announced restart time plus one keepalive interval), taking down all BGP sessions on the router. The neighbor can repeat this each time bgpd restarts.\n * Otherwise: the session stays stuck in the Established state. The neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator runs \"clear bgp \".\n\nThe neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior.\n\n\nRequired configuration: no special configuration is needed. Any BGP neighbor with an established session can trigger the issue under default settings, for example:\n\n router bgp 65001\n neighbor 192.0.2.2 remote-as 65002\n\nGraceful Restart helper mode, which leads to the crash, is enabled by default. With default timers (keepalive 60s, hold time 180s), the session is closed about 6 minutes after the neighbor stops reading."}],"id":"CVE-2026-120033","lastModified":"2026-11-12T19:16:48.393","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]},"published":"2026-11-12T19:16:48.393","references":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5"}],"sourceIdentifier":"57a55968-44ac-464c-a794-6ba3baad09c4","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"},{"lang":"en","value":"CWE-617"}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_fsm.c"],"programRoutines":[{"name":"bgp_event_stop_with_notify"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","status":"unaffected"}],"lessThan":"*","status":"affected","version":"4967bf6d729d7dd14dff7b672b2fd4afe78a0d86","versionType":"git"}]}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up.\n\n\nA BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can cause one of the following:\n\n * If the neighbor announced Graceful Restart support: bgpd crashes shortly after the session is closed (after the neighbor's announced restart time plus one keepalive interval), taking down all BGP sessions on the router. The neighbor can repeat this each time bgpd restarts.\n * Otherwise: the session stays stuck in the Established state. The neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator runs \"clear bgp \".\n\nThe neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior.\n\n\nRequired configuration: no special configuration is needed. Any BGP neighbor with an established session can trigger the issue under default settings, for example:\n\n router bgp 65001\n neighbor 192.0.2.2 remote-as 65002\n\nGraceful Restart helper mode, which leads to the crash, is enabled by default. With default timers (keepalive 60s, hold time 180s), the session is closed about 6 minutes after the neighbor stops reading."}],"id":"CVE-2026-120033","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]},"published":"2026-11-12T19:16:48.393","references":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","url":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5"}],"sourceIdentifier":"57a55968-44ac-464c-a794-6ba3baad09c4","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-372"},{"lang":"en","value":"CWE-617"}],"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120113.json b/data/2026/CVE-2026-120113.json index 0027e87830..dc25352b18 100644 --- a/data/2026/CVE-2026-120113.json +++ b/data/2026/CVE-2026-120113.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:aspera_connect:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_connect:4.2.19:*:*:*:*:*:*:*"],"product":"Aspera Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration."}],"id":"CVE-2026-120113","lastModified":"2026-11-08T18:17:00.950","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Primary"}]},"published":"2026-11-08T18:17:00.837","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295714"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@us.ibm.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:aspera_connect:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:aspera_connect:4.2.19:*:*:*:*:*:*:*"],"product":"Aspera Connect","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration."}],"id":"CVE-2026-120113","lastModified":"2026-11-12T21:17:21.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120113","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T20:05:54.382682Z","version":"2.0.3"}}]},"published":"2026-11-08T18:17:00.837","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7295714"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120139.json b/data/2026/CVE-2026-120139.json index 0c661403c2..9a02669c55 100644 --- a/data/2026/CVE-2026-120139.json +++ b/data/2026/CVE-2026-120139.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120139","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.420","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120139/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120139","lastModified":"2026-11-12T22:19:07.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120139","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:17:44.974636Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.420","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120139/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120141.json b/data/2026/CVE-2026-120141.json index 9b337888e3..aac23280e9 100644 --- a/data/2026/CVE-2026-120141.json +++ b/data/2026/CVE-2026-120141.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120141","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.547","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120141/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120141","lastModified":"2026-11-12T22:19:07.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120141","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:16:05.818315Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.547","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120141/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120142.json b/data/2026/CVE-2026-120142.json index 9e44ac36b4..4396e1696a 100644 --- a/data/2026/CVE-2026-120142.json +++ b/data/2026/CVE-2026-120142.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-120142","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.660","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120142/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."}],"id":"CVE-2026-120142","lastModified":"2026-11-12T22:19:07.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120142","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:15:35.936188Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.660","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120142/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120143.json b/data/2026/CVE-2026-120143.json index 90dbf13aa2..7a398bb6a4 100644 --- a/data/2026/CVE-2026-120143.json +++ b/data/2026/CVE-2026-120143.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120143","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.790","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120143/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120143","lastModified":"2026-11-12T22:19:07.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120143","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:14:47.847798Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.790","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120143/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120144.json b/data/2026/CVE-2026-120144.json index 7705ae1ee5..cc83e0aa01 100644 --- a/data/2026/CVE-2026-120144.json +++ b/data/2026/CVE-2026-120144.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-120144","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:42.930","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120144/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."}],"id":"CVE-2026-120144","lastModified":"2026-11-12T22:19:07.937","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120144","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:12:53.488800Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:42.930","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120144/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120151.json b/data/2026/CVE-2026-120151.json index f18a20b4ef..63785114d2 100644 --- a/data/2026/CVE-2026-120151.json +++ b/data/2026/CVE-2026-120151.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120151","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.817","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120151/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120151","lastModified":"2026-11-12T22:19:08.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:12:23.099879Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.817","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120151/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120152.json b/data/2026/CVE-2026-120152.json index 85648d49b6..2ddedc3ff6 100644 --- a/data/2026/CVE-2026-120152.json +++ b/data/2026/CVE-2026-120152.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-120152","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:43.940","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120152/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."}],"id":"CVE-2026-120152","lastModified":"2026-11-12T22:19:08.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:11:31.172233Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:43.940","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120152/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120153.json b/data/2026/CVE-2026-120153.json index 517b0ee814..fdbb576b3b 100644 --- a/data/2026/CVE-2026-120153.json +++ b/data/2026/CVE-2026-120153.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120153","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.073","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120153/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120153","lastModified":"2026-11-12T22:19:08.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120153","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:11:23.802259Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:44.073","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120153/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120154.json b/data/2026/CVE-2026-120154.json index b67104e0de..f44496b495 100644 --- a/data/2026/CVE-2026-120154.json +++ b/data/2026/CVE-2026-120154.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120154","lastModified":"2026-11-12T19:02:35.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]},"published":"2026-11-12T15:17:44.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120154/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PostgreSQL","vendor":"n/a","versions":[{"lessThan":"18.7","status":"affected","version":"18","versionType":"rpm"},{"lessThan":"17.12","status":"affected","version":"17","versionType":"rpm"},{"lessThan":"16.16","status":"affected","version":"16","versionType":"rpm"},{"lessThan":"15.20","status":"affected","version":"15","versionType":"rpm"},{"lessThan":"14.25","status":"affected","version":"0","versionType":"rpm"}]}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}],"id":"CVE-2026-120154","lastModified":"2026-11-12T22:19:08.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120154","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:10:35.332140Z","version":"2.0.3"}}]},"published":"2026-11-12T15:17:44.193","references":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","url":"https://www.postgresql.org/support/security/CVE-2026-120154/"}],"sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-424"}],"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120466.json b/data/2026/CVE-2026-120466.json index e6f4c22469..30d3a4e60f 100644 --- a/data/2026/CVE-2026-120466.json +++ b/data/2026/CVE-2026-120466.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site."}],"id":"CVE-2026-120466","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.017","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site."}],"id":"CVE-2026-120466","lastModified":"2026-11-12T22:19:08.513","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120466","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:34:47.205688Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:18.017","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120467.json b/data/2026/CVE-2026-120467.json index da7bf196ea..d8794a1959 100644 --- a/data/2026/CVE-2026-120467.json +++ b/data/2026/CVE-2026-120467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site."}],"id":"CVE-2026-120467","lastModified":"2026-11-12T19:16:48.553","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T19:16:48.553","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site."}],"id":"CVE-2026-120467","lastModified":"2026-11-12T22:19:08.640","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:33:39.427294Z","version":"2.0.3"}}]},"published":"2026-11-12T19:16:48.553","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120468.json b/data/2026/CVE-2026-120468.json index 5d0d085cc9..13ce94750f 100644 --- a/data/2026/CVE-2026-120468.json +++ b/data/2026/CVE-2026-120468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected."}],"id":"CVE-2026-120468","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.170","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected."}],"id":"CVE-2026-120468","lastModified":"2026-11-12T22:19:08.767","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120468","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:33:46.842744Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:18.170","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120469.json b/data/2026/CVE-2026-120469.json index 82bdd1e65f..073f090b33 100644 --- a/data/2026/CVE-2026-120469.json +++ b/data/2026/CVE-2026-120469.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain."}],"id":"CVE-2026-120469","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.330","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain."}],"id":"CVE-2026-120469","lastModified":"2026-11-12T22:19:08.873","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:34:37.141805Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:18.330","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120470.json b/data/2026/CVE-2026-120470.json index a703f9c455..b983c0b4a0 100644 --- a/data/2026/CVE-2026-120470.json +++ b/data/2026/CVE-2026-120470.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience."}],"id":"CVE-2026-120470","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.490","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla and WordPress","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience."}],"id":"CVE-2026-120470","lastModified":"2026-11-12T22:19:09.010","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120470","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:34:57.161653Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:18.490","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120471.json b/data/2026/CVE-2026-120471.json index d2d3e35de5..e4f9f71f25 100644 --- a/data/2026/CVE-2026-120471.json +++ b/data/2026/CVE-2026-120471.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected."}],"id":"CVE-2026-120471","lastModified":"2026-11-12T19:09:06.967","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}]},"published":"2026-11-12T18:17:18.633","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"AcyMailing extension for Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0.0-11.1.1"}]}],"source":"security@joomla.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected."}],"id":"CVE-2026-120471","lastModified":"2026-11-12T22:19:09.130","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@joomla.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120471","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-12T21:34:29.566785Z","version":"2.0.3"}}]},"published":"2026-11-12T18:17:18.633","references":[{"source":"security@joomla.org","url":"https://www.acymailing.com/"}],"sourceIdentifier":"security@joomla.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@joomla.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120499.json b/data/2026/CVE-2026-120499.json index efbaa23c3a..4b904ed57b 100644 --- a/data/2026/CVE-2026-120499.json +++ b/data/2026/CVE-2026-120499.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/h5io","product":"h5io","repo":"https://github.com/h5io/h5io","vendor":"h5io","versions":[{"lessThan":"0.2.6","status":"affected","version":"0.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read."}],"id":"CVE-2026-120499","lastModified":"2026-11-05T19:17:14.713","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T18:30:02.460697Z","version":"2.0.3"}}]},"published":"2026-11-05T17:18:00.097","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io/_h5io.py#L601-L604"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/releases/tag/h5io-0.2.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"},{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/h5io","product":"h5io","repo":"https://github.com/h5io/h5io","vendor":"h5io","versions":[{"lessThan":"0.2.6","status":"affected","version":"0.1.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary code by supplying a crafted HDF5 file. Attackers can store Python code in a node titled timezone, which _triage_read() passes to eval() with builtins reachable, name an arbitrary module in class or custom-object nodes that _import_class() imports, or place pickled objects in pd_dataframe or pd_series nodes that pandas deserializes on read."}],"id":"CVE-2026-120499","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120499","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-05T18:30:02.460697Z","version":"2.0.3"}}]},"published":"2026-11-05T17:18:00.097","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/blob/h5io-0.2.5/h5io/_h5io.py#L601-L604"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/commit/afff1d61b31790f8c27e6c577bb7703eb1883ddd"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/releases/tag/h5io-0.2.6"},{"source":"disclosure@vulncheck.com","url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/h5io-before-0.2.6-arbitrary-code-execution-via-read-hdf5"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/h5io/h5io/security/advisories/GHSA-vwvw-f6v4-w737"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"},{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-12067.json b/data/2026/CVE-2026-12067.json index 8a943d5303..19b7327516 100644 --- a/data/2026/CVE-2026-12067.json +++ b/data/2026/CVE-2026-12067.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows"],"product":"Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"affected","platforms":["Windows"],"product":"AVG Antivirus Free, AVG Internet Security, AVG Ultimate","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"affected","platforms":["Windows"],"product":"Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@nortonlifelock.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.\n\n\n\nThe vulnerability spans multiple handler pathways in the RPC-based native message protocol:\n\n * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. \n * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.\n * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.\n\n\nIn all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain."}],"id":"CVE-2026-12067","lastModified":"2026-11-10T19:21:14.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:34:00.891220Z","version":"2.0.3"}}]},"published":"2026-11-06T16:17:55.640","references":[{"source":"security@nortonlifelock.com","url":"https://support.avast.com/en-us/article/Update-Antivirus"},{"source":"security@nortonlifelock.com","url":"https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus"},{"source":"security@nortonlifelock.com","url":"https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167"},{"source":"security@nortonlifelock.com","url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"}],"sourceIdentifier":"security@nortonlifelock.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-391"}],"source":"security@nortonlifelock.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"affected","platforms":["Windows"],"product":"Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"affected","platforms":["Windows"],"product":"AVG Antivirus Free, AVG Internet Security, AVG Ultimate","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"affected","platforms":["Windows"],"product":"Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced","vendor":"Gen Digital","versions":[{"lessThan":"26.7","status":"affected","version":"0","versionType":"custom"}]}],"source":"security@nortonlifelock.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged attacker to crash the service by sending specially crafted JSON messages.\n\n\n\nThe vulnerability spans multiple handler pathways in the RPC-based native message protocol:\n\n * Log_NmSvc.message handler: converts JSON fields to strings without type validation and without exception boundaries. \n * OpenInSz_NmSvc handler: converts URL and origin fields to strings without type checking, exposing an exception.\n * OpenInSz_NmSvc.profile handler: converts the profile field to an integer without validation.\n\n\nIn all three cases, the exceptions are not caught by action-specific handlers and propagate up the dispatcher. The common root cause is the absence of try-catch blocks around JSON type conversions in the native message processing chain."}],"id":"CVE-2026-12067","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-12067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T18:34:00.891220Z","version":"2.0.3"}}]},"published":"2026-11-06T16:17:55.640","references":[{"source":"security@nortonlifelock.com","url":"https://support.avast.com/en-us/article/Update-Antivirus"},{"source":"security@nortonlifelock.com","url":"https://support.avg.com/SupportArticleView?l=en&urlname=Update-AVG-Antivirus"},{"source":"security@nortonlifelock.com","url":"https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167"},{"source":"security@nortonlifelock.com","url":"https://www.gendigital.com/us/en/contact-us/security-advisories/"}],"sourceIdentifier":"security@nortonlifelock.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-248"},{"lang":"en","value":"CWE-391"}],"source":"security@nortonlifelock.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120859.json b/data/2026/CVE-2026-120859.json index cbc5b02c01..92d3672f6c 100644 --- a/data/2026/CVE-2026-120859.json +++ b/data/2026/CVE-2026-120859.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq","product":"PyMoDAQ","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"4.4.13","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-data","product":"pymodaq_data","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-gui","product":"pymodaq_gui","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-utils","product":"pymodaq_utils","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate."}],"id":"CVE-2026-120859","lastModified":"2026-11-09T23:17:14.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120859","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:23:03.047870Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:05.323","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pymodaq-before-5.3.10-arbitrary-code-execution-via-crafted-hdf5-dock-layout-and-xml-settings-files"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"},{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq","product":"PyMoDAQ","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"4.4.13","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-data","product":"pymodaq_data","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-gui","product":"pymodaq_gui","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:pypi/pymodaq-utils","product":"pymodaq_utils","repo":"https://github.com/PyMoDAQ/PyMoDAQ","vendor":"PyMoDAQ","versions":[{"lessThan":"5.1.15","status":"affected","version":"0","versionType":"semver"},{"lessThan":"5.2.14","status":"affected","version":"5.2.0","versionType":"semver"},{"lessThan":"5.3.10","status":"affected","version":"5.3.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x before 5.3.10, contain deserialization of untrusted data and eval injection vulnerabilities that allow attackers to execute arbitrary code by supplying crafted files that a user opens. Attackers can store pickled objects in HDF5 string nodes that StringARRAY.array_to_string() passes to pickle.loads() when the node is browsed or read, place Python expressions in HDF5 attributes that JsonConverter.json2object() evaluates, supply a .dock file that load_layout_state() unpickles from the Dashboard Load layout action, or embed Python expressions in XML settings files that elt_to_dict() and set_txt_from_elt() evaluate."}],"id":"CVE-2026-120859","lastModified":"2026-11-12T21:09:09.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-120859","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T22:23:03.047870Z","version":"2.0.3"}}]},"published":"2026-11-05T18:17:05.323","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/blob/5.3.9/packages/pymodaq_data/src/pymodaq_data/h5modules/backends.py#L477-L478"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/041e8a22b3dbe3c986ec0ea3c6b46a22f5efe374"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/3bf9042a58f5d4870a2b45fe2c9423aafe6b9203"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/6c7fff74d82624c640bd79513f5b4675ea6d88da"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/commit/ae0042513eb979c84da690825902658c625718d1"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/4.4.13"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.1.15"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.2.14"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/releases/tag/5.3.10"},{"source":"disclosure@vulncheck.com","url":"https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pymodaq-before-5.3.10-arbitrary-code-execution-via-crafted-hdf5-dock-layout-and-xml-settings-files"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/PyMoDAQ/PyMoDAQ/security/advisories/GHSA-jw9g-5c9x-cf84"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-95"},{"lang":"en","value":"CWE-502"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-120869.json b/data/2026/CVE-2026-120869.json index 3bca295b5b..63ea7b87a2 100644 --- a/data/2026/CVE-2026-120869.json +++ b/data/2026/CVE-2026-120869.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Console","vendor":"Citrix NetScaler","versions":[{"lessThan":"14.1-74.34","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance"}],"id":"CVE-2026-120869","lastModified":"2026-11-12T14:17:23.990","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-12T14:17:23.990","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Received"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Console","vendor":"Citrix NetScaler","versions":[{"lessThan":"14.1-74.34","status":"affected","version":"0","versionType":"patch"}]}],"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance"}],"id":"CVE-2026-120869","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","type":"Secondary"}]},"published":"2026-11-12T14:17:23.990","references":[{"source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697320"}],"sourceIdentifier":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","vulnStatus":"Awaiting Analysis"} diff --git a/data/2026/CVE-2026-121577.json b/data/2026/CVE-2026-121577.json index 868ddb7329..f113bcf435 100644 --- a/data/2026/CVE-2026-121577.json +++ b/data/2026/CVE-2026-121577.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageName":"whatstk","product":"whatstk","programFiles":["whatstk/whatsapp/parser.py","whatstk/whatsapp/auto_header.py"],"repo":"https://github.com/lucasrodes/whatstk","vendor":"lucasrodes","versions":[{"lessThan":"0.9.0","status":"affected","version":"0.2.0","versionType":"semver"}]}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P\\d{1,2})+(?P\\d{1,2})+(?P\\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \\ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program."}],"id":"CVE-2026-121577","lastModified":"2026-11-06T20:17:19.773","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:49:38.845810Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:13.290","references":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/commit/01d66d8"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/pull/181"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://secur0.com/en/cna/cve-list/cve-2026-121577-whatstk-header-regex-redos"}],"sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageName":"whatstk","product":"whatstk","programFiles":["whatstk/whatsapp/parser.py","whatstk/whatsapp/auto_header.py"],"repo":"https://github.com/lucasrodes/whatstk","vendor":"lucasrodes","versions":[{"lessThan":"0.9.0","status":"affected","version":"0.2.0","versionType":"semver"}]}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P\\d{1,2})+(?P\\d{1,2})+(?P\\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \\ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program."}],"id":"CVE-2026-121577","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T19:49:38.845810Z","version":"2.0.3"}}]},"published":"2026-11-03T20:18:13.290","references":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/commit/01d66d8"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/pull/181"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://secur0.com/en/cna/cve-list/cve-2026-121577-whatstk-header-regex-redos"}],"sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-1333"}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121587.json b/data/2026/CVE-2026-121587.json index 2ff4d72f4e..900bcd70b8 100644 --- a/data/2026/CVE-2026-121587.json +++ b/data/2026/CVE-2026-121587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/coollabsio/coolify","defaultStatus":"unaffected","packageURL":"pkg:github/coollabsio/coolify","product":"coolify","repo":"https://github.com/coollabsio/coolify","vendor":"coollabsio","versions":[{"lessThan":"4.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification."}],"id":"CVE-2026-121587","lastModified":"2026-11-07T04:17:25.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121587","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:13:00.919667Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/pull/10361"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/releases/tag/v4.1.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/coollabsio/coolify","defaultStatus":"unaffected","packageURL":"pkg:github/coollabsio/coolify","product":"coolify","repo":"https://github.com/coollabsio/coolify","vendor":"coollabsio","versions":[{"lessThan":"4.1.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification."}],"id":"CVE-2026-121587","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121587","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:13:00.919667Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/blob/v4.1.0/app/Http/Controllers/Webhook/Github.php#L69"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/commit/809d9b21fa9609de2ce9b49bb838c079598da876"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/commit/c1518ba1c0be36da42b6cef06df4b042f5733b01"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/pull/10361"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coollabsio/coolify/releases/tag/v4.1.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coolify-before-4.1.1-application-name-enumeration-via-manual-webhook-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121588.json b/data/2026/CVE-2026-121588.json index d1e19fe943..ecfff2981f 100644 --- a/data/2026/CVE-2026-121588.json +++ b/data/2026/CVE-2026-121588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/TeXlyre/texlyre","defaultStatus":"unaffected","packageURL":"pkg:github/TeXlyre/texlyre","product":"texlyre","repo":"https://github.com/TeXlyre/texlyre","vendor":"TeXlyre","versions":[{"lessThan":"0.13.5","status":"affected","version":"0.11.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials."}],"id":"CVE-2026-121588","lastModified":"2026-11-09T16:17:29.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121588","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:20:05.308867Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.220","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/blob/9621db54893cc2203be5aed8615f54a17653be4d/src/components/settings/ToolConfigCards.tsx#L174"},{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/commit/92b50ca050af8473f0fd51a048a7e1d60dcdb2dc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/texlyre-from-0.11.0-before-0.13.5-stored-xss-via-recipe-icon-import"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/TeXlyre/texlyre","defaultStatus":"unaffected","packageURL":"pkg:github/TeXlyre/texlyre","product":"texlyre","repo":"https://github.com/TeXlyre/texlyre","vendor":"TeXlyre","versions":[{"lessThan":"0.13.5","status":"affected","version":"0.11.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials."}],"id":"CVE-2026-121588","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121588","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:20:05.308867Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.220","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/blob/9621db54893cc2203be5aed8615f54a17653be4d/src/components/settings/ToolConfigCards.tsx#L174"},{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/commit/92b50ca050af8473f0fd51a048a7e1d60dcdb2dc"},{"source":"disclosure@vulncheck.com","url":"https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/texlyre-from-0.11.0-before-0.13.5-stored-xss-via-recipe-icon-import"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/TeXlyre/texlyre/security/advisories/GHSA-gg75-v533-34cq"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121602.json b/data/2026/CVE-2026-121602.json index 00d6a9c5f5..9e0b51d847 100644 --- a/data/2026/CVE-2026-121602.json +++ b/data/2026/CVE-2026-121602.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/solanum-ircd/solanum","defaultStatus":"unaffected","packageURL":"pkg:github/solanum-ircd/solanum","product":"solanum","repo":"https://github.com/solanum-ircd/solanum","vendor":"solanum-ircd","versions":[{"lessThan":"2ce64debf65e9710e9eea099ada93dbf6655b5ff","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution."}],"id":"CVE-2026-121602","lastModified":"2026-11-03T19:18:05.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:47:30.495862Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.387","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/pull/551"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/solanum-ircd/solanum","defaultStatus":"unaffected","packageURL":"pkg:github/solanum-ircd/solanum","product":"solanum","repo":"https://github.com/solanum-ircd/solanum","vendor":"solanum-ircd","versions":[{"lessThan":"2ce64debf65e9710e9eea099ada93dbf6655b5ff","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution."}],"id":"CVE-2026-121602","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:47:30.495862Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.387","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/ircd/channel.c#L371-L385"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/2ea1382e4262b212a91034258c466f0f6754cd61/modules/core/m_join.c#L507"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/commit/2ce64debf65e9710e9eea099ada93dbf6655b5ff"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/pull/551"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/solanum-before-commit-2ce64de-heap-buffer-overflow-via-join-and-sjoin"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121603.json b/data/2026/CVE-2026-121603.json index ea7364e2b6..910adbbd0f 100644 --- a/data/2026/CVE-2026-121603.json +++ b/data/2026/CVE-2026-121603.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/solanum-ircd/solanum","defaultStatus":"unaffected","packageURL":"pkg:github/solanum-ircd/solanum","product":"solanum","repo":"https://github.com/solanum-ircd/solanum","vendor":"solanum-ircd","versions":[{"lessThan":"2ea1382e4262b212a91034258c466f0f6754cd61","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution."}],"id":"CVE-2026-121603","lastModified":"2026-11-03T18:17:58.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:15:57.210109Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/7bc7e34c04711247b932666e19ae900cba884540/modules/core/m_kill.c#L277"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/commit/2ea1382e4262b212a91034258c466f0f6754cd61"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/pull/550"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/solanum-before-commit-2ea1382-buffer-overflow-via-server-to-server-kill-handler"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/solanum-ircd/solanum","defaultStatus":"unaffected","packageURL":"pkg:github/solanum-ircd/solanum","product":"solanum","repo":"https://github.com/solanum-ircd/solanum","vendor":"solanum-ircd","versions":[{"lessThan":"2ea1382e4262b212a91034258c466f0f6754cd61","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution."}],"id":"CVE-2026-121603","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:15:57.210109Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.567","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/blob/7bc7e34c04711247b932666e19ae900cba884540/modules/core/m_kill.c#L277"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/commit/2ea1382e4262b212a91034258c466f0f6754cd61"},{"source":"disclosure@vulncheck.com","url":"https://github.com/solanum-ircd/solanum/pull/550"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/solanum-before-commit-2ea1382-buffer-overflow-via-server-to-server-kill-handler"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121604.json b/data/2026/CVE-2026-121604.json index 7692b4d8a9..3c013540dc 100644 --- a/data/2026/CVE-2026-121604.json +++ b/data/2026/CVE-2026-121604.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://gitlab.freedesktop.org/wlroots/wlroots","defaultStatus":"unaffected","product":"wlroots","repo":"https://gitlab.freedesktop.org/wlroots/wlroots","vendor":"wlroots","versions":[{"lessThan":"0.20.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC."}],"id":"CVE-2026-121604","lastModified":"2026-11-07T04:17:26.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:14:25.336787Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.737","references":[{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://gitlab.freedesktop.org/wlroots/wlroots","defaultStatus":"unaffected","product":"wlroots","repo":"https://gitlab.freedesktop.org/wlroots/wlroots","vendor":"wlroots","versions":[{"lessThan":"0.20.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WM_CLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the window class or app_id over IPC."}],"id":"CVE-2026-121604","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:14:25.336787Z","version":"2.0.3"}}]},"published":"2026-11-03T17:18:11.737","references":[{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/blob/0.20.1/xwayland/xwm.c#L661-L678"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/4412992469540b1d578cb94a5cd4e6e5829812dc"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/commit/851cdd0089004884bd85a95ad21f04009cb5a53a"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/merge_requests/5374"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/releases/0.20.2"},{"source":"disclosure@vulncheck.com","url":"https://gitlab.freedesktop.org/wlroots/wlroots/-/work_items/4092"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wlroots-before-0.20.2-out-of-bounds-read-via-read-surface-class-in-xwm-c"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121620.json b/data/2026/CVE-2026-121620.json index efe560f9df..3017d68582 100644 --- a/data/2026/CVE-2026-121620.json +++ b/data/2026/CVE-2026-121620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/coopcycle/coopcycle-web","product":"coopcycle-web","repo":"https://github.com/coopcycle/coopcycle-web","vendor":"CoopCycle","versions":[{"lessThan":"6.20.0","status":"affected","version":"5.6.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states."}],"id":"CVE-2026-121620","lastModified":"2026-11-04T19:17:31.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:48:16.550535Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.537","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/coopcycle/coopcycle-web","product":"coopcycle-web","repo":"https://github.com/coopcycle/coopcycle-web","vendor":"CoopCycle","versions":[{"lessThan":"6.20.0","status":"affected","version":"5.6.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states."}],"id":"CVE-2026-121620","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.3,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:48:16.550535Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.537","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/config/packages/security.yaml#L328-L330"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Integration/Zelty/ZeltyCatalogProcessor.php#L51-L57"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/commit/9b499950d433ca8ba894996d6b17f49885ca9485"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/releases/tag/v6.20.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-5.6.0-before-6.20.0-missing-zelty-webhook-signature-verification"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121624.json b/data/2026/CVE-2026-121624.json index 3956cb1a6d..f587ad066f 100644 --- a/data/2026/CVE-2026-121624.json +++ b/data/2026/CVE-2026-121624.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Supremo","vendor":"Nanosystems","versions":[{"lessThan":"5.0.2.3874","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."}],"id":"CVE-2026-121624","lastModified":"2026-11-03T23:17:35.730","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:34.514075Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.270","references":[{"source":"disclosure@vulncheck.com","url":"https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"},{"source":"disclosure@vulncheck.com","url":"https://www.supremocontrol.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.supremocontrol.com/changelog/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Supremo","vendor":"Nanosystems","versions":[{"lessThan":"5.0.2.3874","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."}],"id":"CVE-2026-121624","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.6,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:36:34.514075Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.270","references":[{"source":"disclosure@vulncheck.com","url":"https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"},{"source":"disclosure@vulncheck.com","url":"https://www.supremocontrol.com/"},{"source":"disclosure@vulncheck.com","url":"https://www.supremocontrol.com/changelog/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121625.json b/data/2026/CVE-2026-121625.json index 1405f2b736..2c6e980111 100644 --- a/data/2026/CVE-2026-121625.json +++ b/data/2026/CVE-2026-121625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gnugk","vendor":"willamowius","versions":[{"lessThan":"5.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper."}],"id":"CVE-2026-121625","lastModified":"2026-11-03T18:17:58.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:24:07.685551Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.440","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxx#L14867-L14895"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/releases/tag/v5_16"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gnugk","vendor":"willamowius","versions":[{"lessThan":"5.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper."}],"id":"CVE-2026-121625","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T17:24:07.685551Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.440","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/blob/v5_15/ProxyChannel.cxx#L14867-L14895"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/commit/e8939d03b0b2ef46e356f3144a6ee14f2920b777"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/releases/tag/v5_16"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-via-rtcp-sdes-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-121626.json b/data/2026/CVE-2026-121626.json index 6dae78af70..951e134710 100644 --- a/data/2026/CVE-2026-121626.json +++ b/data/2026/CVE-2026-121626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gnugk","vendor":"willamowius","versions":[{"lessThan":"5.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper."}],"id":"CVE-2026-121626","lastModified":"2026-11-07T04:17:27.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:19:14.533230Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.623","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/releases/tag/v5_16"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"gnugk","vendor":"willamowius","versions":[{"lessThan":"5.16","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket() that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24 probing to read past the heap allocation and possibly crash the gatekeeper."}],"id":"CVE-2026-121626","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:19:14.533230Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.623","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/blob/v5_15/GkClient.cxx#L963-L990"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/commit/160aa27344ecc9a443cccaa63e8d7fa95a766610"},{"source":"disclosure@vulncheck.com","url":"https://github.com/willamowius/gnugk/releases/tag/v5_16"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/gnu-gatekeeper-before-5.16-out-of-bounds-read-in-h-460.24-rtcp-probe-handler"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121627.json b/data/2026/CVE-2026-121627.json index 2a71b8ac74..dc993d7c14 100644 --- a/data/2026/CVE-2026-121627.json +++ b/data/2026/CVE-2026-121627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/buku","product":"buku","vendor":"jarun","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"5.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials."}],"id":"CVE-2026-121627","lastModified":"2026-11-09T16:17:30.027","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:25:46.592449Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.790","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku/issues/911"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:pypi/buku","product":"buku","vendor":"jarun","versions":[{"lessThanOrEqual":"5.1.1","status":"affected","version":"5.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials."}],"id":"CVE-2026-121627","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:25:46.592449Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.790","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py#L133"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jarun/buku/issues/911"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/buku-5.0-through-5.1.1-stored-xss-via-bukuserver-bookmark-list-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121628.json b/data/2026/CVE-2026-121628.json index 739dbd4649..5f51d79e7c 100644 --- a/data/2026/CVE-2026-121628.json +++ b/data/2026/CVE-2026-121628.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/bagisto/bagisto","product":"bagisto","vendor":"bagisto","versions":[{"lessThan":"2.3.16","status":"affected","version":"0","versionType":"semver"},{"lessThan":"2.4.1","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"unaffected","version":"2.3.16","versionType":"semver"},{"status":"unaffected","version":"2.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly."}],"id":"CVE-2026-121628","lastModified":"2026-11-03T23:17:35.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121628","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:38:09.792685Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.990","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.3.16"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.4.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/bagisto/bagisto","product":"bagisto","vendor":"bagisto","versions":[{"lessThan":"2.3.16","status":"affected","version":"0","versionType":"semver"},{"lessThan":"2.4.1","status":"affected","version":"2.4.0","versionType":"semver"},{"status":"unaffected","version":"2.3.16","versionType":"semver"},{"status":"unaffected","version":"2.4.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly."}],"id":"CVE-2026-121628","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121628","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-03T22:38:09.792685Z","version":"2.0.3"}}]},"published":"2026-11-03T18:17:58.990","references":[{"source":"disclosure@vulncheck.com","url":"https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.3.16"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.4.1"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121691.json b/data/2026/CVE-2026-121691.json index 8b53c638f4..971791ef81 100644 --- a/data/2026/CVE-2026-121691.json +++ b/data/2026/CVE-2026-121691.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageName":"whatstk","product":"whatstk","programFiles":["whatstk/whatsapp/parser.py"],"repo":"https://github.com/lucasrodes/whatstk","vendor":"lucasrodes","versions":[{"lessThan":"0.9.0","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loader of whatstk from 0.7.0 before 0.9.0 allows a party that supplies a chat export to exhaust the memory and the disk of the process that parses it, because _str_from_file() (whatstk/whatsapp/parser.py) calls zip_ref.extractall() with no bound on the size of the members and no check of the compression ratio, then reads the extracted file in full with f.read(). The only guard on the archive counts the extracted files and raises when there is not exactly one, but it runs after extractall() has already written them, so it does not prevent the cost. _clean_text() then passes the whole text through unicodedata.normalize(\"NFKD\", text), which holds a second copy, and the parse builds a list of regular expression matches and a DataFrame over it, so peak memory is a multiple of the decompressed text rather than of the archive. A ZIP is a documented input of WhatsAppChat.from_source() and df_from_whatsapp(), and is the form in which WhatsApp exports a chat on iOS, so the attacker supplies the whole file. This results in a small upload costing hundreds of megabytes of memory and of disk, and in the process being killed where that exceeds what is available."}],"id":"CVE-2026-121691","lastModified":"2026-11-10T18:17:20.640","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]},"published":"2026-11-10T18:17:20.640","references":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/commit/01d66d8"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/pull/182"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://secur0.com/en/cna/cve-list/cve-2026-121691-whatstk-zip-decompression-bomb"}],"sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pypi.org","defaultStatus":"unaffected","packageName":"whatstk","product":"whatstk","programFiles":["whatstk/whatsapp/parser.py"],"repo":"https://github.com/lucasrodes/whatstk","vendor":"lucasrodes","versions":[{"lessThan":"0.9.0","status":"affected","version":"0.7.0","versionType":"semver"}]}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loader of whatstk from 0.7.0 before 0.9.0 allows a party that supplies a chat export to exhaust the memory and the disk of the process that parses it, because _str_from_file() (whatstk/whatsapp/parser.py) calls zip_ref.extractall() with no bound on the size of the members and no check of the compression ratio, then reads the extracted file in full with f.read(). The only guard on the archive counts the extracted files and raises when there is not exactly one, but it runs after extractall() has already written them, so it does not prevent the cost. _clean_text() then passes the whole text through unicodedata.normalize(\"NFKD\", text), which holds a second copy, and the parse builds a list of regular expression matches and a DataFrame over it, so peak memory is a multiple of the decompressed text rather than of the archive. A ZIP is a documented input of WhatsAppChat.from_source() and df_from_whatsapp(), and is the form in which WhatsApp exports a chat on iOS, so the attacker supplies the whole file. This results in a small upload costing hundreds of megabytes of memory and of disk, and in the process being killed where that exceeds what is available."}],"id":"CVE-2026-121691","lastModified":"2026-11-12T22:11:01.153","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]},"published":"2026-11-10T18:17:20.640","references":[{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/commit/01d66d8"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/pull/182"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0"},{"source":"4daa8cea-433a-44bd-9456-53b127fc289a","url":"https://secur0.com/en/cna/cve-list/cve-2026-121691-whatstk-zip-decompression-bomb"}],"sourceIdentifier":"4daa8cea-433a-44bd-9456-53b127fc289a","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-409"}],"source":"4daa8cea-433a-44bd-9456-53b127fc289a","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121727.json b/data/2026/CVE-2026-121727.json index 9eb5e277ce..324158bd33 100644 --- a/data/2026/CVE-2026-121727.json +++ b/data/2026/CVE-2026-121727.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jorisvink/kore","product":"kore","vendor":"jorisvink","versions":[{"lessThan":"4.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory."}],"id":"CVE-2026-121727","lastModified":"2026-11-09T16:17:30.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121727","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:52:08.663146Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.043","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b"},{"source":"disclosure@vulncheck.com","url":"https://kore.io/releases/4.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/jorisvink/kore","product":"kore","vendor":"jorisvink","versions":[{"lessThan":"4.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory."}],"id":"CVE-2026-121727","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121727","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:52:08.663146Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.043","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore/blob/4.3.0-rc5/src/http.c#L934"},{"source":"disclosure@vulncheck.com","url":"https://github.com/jorisvink/kore/commit/1ff3c0f6f7973dc7fc8bf38369790ef2d8079b3b"},{"source":"disclosure@vulncheck.com","url":"https://kore.io/releases/4.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/kore-before-4.3.0-integer-underflow-memory-exhaustion-via-http-header-recv"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121728.json b/data/2026/CVE-2026-121728.json index eb74086421..1e2d0ec083 100644 --- a/data/2026/CVE-2026-121728.json +++ b/data/2026/CVE-2026-121728.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"meta.sr.ht","repo":"https://git.sr.ht/~sircmpwn/meta.sr.ht","vendor":"SourceHut","versions":[{"lessThan":"0.89.0","status":"affected","version":"0.56.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts."}],"id":"CVE-2026-121728","lastModified":"2026-11-09T17:17:17.350","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121728","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:40:25.817987Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.217","references":[{"source":"disclosure@vulncheck.com","url":"https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"meta.sr.ht","repo":"https://git.sr.ht/~sircmpwn/meta.sr.ht","vendor":"SourceHut","versions":[{"lessThan":"0.89.0","status":"affected","version":"0.56.11","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts."}],"id":"CVE-2026-121728","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121728","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:40:25.817987Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.217","references":[{"source":"disclosure@vulncheck.com","url":"https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0"},{"source":"disclosure@vulncheck.com","url":"https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121729.json b/data/2026/CVE-2026-121729.json index 7fd8de4b7d..e2a99bf928 100644 --- a/data/2026/CVE-2026-121729.json +++ b/data/2026/CVE-2026-121729.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/0xdps/emailflare","product":"emailflare","vendor":"0xdps","versions":[{"lessThan":"cf31f33bbb4a324d5353b8a5db0312fedc19618f","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations."}],"id":"CVE-2026-121729","lastModified":"2026-11-04T19:17:32.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121729","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:57:24.607788Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.407","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/0xdps/emailflare","product":"emailflare","vendor":"0xdps","versions":[{"lessThan":"cf31f33bbb4a324d5353b8a5db0312fedc19618f","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations."}],"id":"CVE-2026-121729","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121729","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:57:24.607788Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.407","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/keys.ts"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-api-keys-routes"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121730.json b/data/2026/CVE-2026-121730.json index 91e0d5fdf1..5058fee90d 100644 --- a/data/2026/CVE-2026-121730.json +++ b/data/2026/CVE-2026-121730.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/0xdps/emailflare","product":"emailflare","vendor":"0xdps","versions":[{"lessThan":"cf31f33bbb4a324d5353b8a5db0312fedc19618f","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients."}],"id":"CVE-2026-121730","lastModified":"2026-11-07T04:17:27.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:37:28.092337Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.590","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/0xdps/emailflare","product":"emailflare","vendor":"0xdps","versions":[{"lessThan":"cf31f33bbb4a324d5353b8a5db0312fedc19618f","status":"affected","version":"0","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate other users or the organization to external recipients."}],"id":"CVE-2026-121730","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:37:28.092337Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:36.590","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/blob/d448ea205937a5e82683f89013d4c23159da5b7d/services/inbox-worker/src/routes/inbox/compose.ts"},{"source":"disclosure@vulncheck.com","url":"https://github.com/0xdps/emailflare/commit/cf31f33bbb4a324d5353b8a5db0312fedc19618f"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/emailflare-before-commit-cf31f33-missing-authorization-via-inbox-compose-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121733.json b/data/2026/CVE-2026-121733.json index b763d3fc69..42d402a6f1 100644 --- a/data/2026/CVE-2026-121733.json +++ b/data/2026/CVE-2026-121733.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/bagisto/bagisto","product":"Bagisto","vendor":"Webkul","versions":[{"lessThan":"2.4.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it."}],"id":"CVE-2026-121733","lastModified":"2026-11-04T19:17:32.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121733","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:58:00.446403Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.177","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/204e43c26705b66ef2ddfb2a9eebb25f5e8f6a2c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.4.5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bagisto-before-2.4.5-stored-xss-via-rma-conversation-attachment-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/bagisto/bagisto","product":"Bagisto","vendor":"Webkul","versions":[{"lessThan":"2.4.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it."}],"id":"CVE-2026-121733","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121733","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:58:00.446403Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.177","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/blob/v2.4.4/packages/Webkul/Shop/src/Http/Controllers/Customer/Account/RMAController.php#L408"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/204e43c26705b66ef2ddfb2a9eebb25f5e8f6a2c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a99cf153ac338466720acd9004"},{"source":"disclosure@vulncheck.com","url":"https://github.com/bagisto/bagisto/releases/tag/v2.4.5"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/bagisto-before-2.4.5-stored-xss-via-rma-conversation-attachment-upload"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121734.json b/data/2026/CVE-2026-121734.json index eae64b161c..657138e227 100644 --- a/data/2026/CVE-2026-121734.json +++ b/data/2026/CVE-2026-121734.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/zane-ops/zane-ops","product":"zane-ops","vendor":"zane-ops","versions":[{"lessThan":"1.15.2","status":"affected","version":"1.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials."}],"id":"CVE-2026-121734","lastModified":"2026-11-07T04:17:28.310","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121734","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:38:13.932833Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/zane-ops/zane-ops","product":"zane-ops","vendor":"zane-ops","versions":[{"lessThan":"1.15.2","status":"affected","version":"1.14.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials."}],"id":"CVE-2026-121734","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121734","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-07T03:38:13.932833Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121735.json b/data/2026/CVE-2026-121735.json index 2a3b93b85d..ab37ace1fe 100644 --- a/data/2026/CVE-2026-121735.json +++ b/data/2026/CVE-2026-121735.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job."}],"id":"CVE-2026-121735","lastModified":"2026-11-09T16:17:30.697","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:54:07.910486Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.540","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blueprintue/blueprintue-self-hosted-edition","product":"blueprintue-self-hosted-edition","vendor":"blueprintue","versions":[{"lessThan":"4.3.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmed_sent_at. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job."}],"id":"CVE-2026-121735","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121735","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T15:54:07.910486Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.540","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/models/UserModel.php#L361-L368"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/8bba1615bf76b144ac5cd72637c243490f08bc37"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/266"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-qp6g-7v4v-33r9"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-before-4.3.4-non-expiring-account-confirmation-tokens"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121736.json b/data/2026/CVE-2026-121736.json index f25cbb82f7..80d12878db 100644 --- a/data/2026/CVE-2026-121736.json +++ b/data/2026/CVE-2026-121736.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nocodb","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0.300.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting."}],"id":"CVE-2026-121736","lastModified":"2026-11-09T17:17:17.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121736","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:33:45.292205Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.730","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts#L56-L92"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/releases/tag/2026.08.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-532v-ccph-m3xg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-0.300.0-before-2026.08.0-unauthenticated-oauth-authorization-code-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/nocodb","product":"nocodb","vendor":"nocodb","versions":[{"lessThan":"2026.08.0","status":"affected","version":"0.300.0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_id, redirect_uri and approved=true to insert unbounded ownerless authorization code records, limited only by rate limiting."}],"id":"CVE-2026-121736","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121736","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T16:33:45.292205Z","version":"2.0.3"}}]},"published":"2026-11-03T23:17:37.730","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/blob/2026.07.0/packages/nocodb/src/modules/oauth/controllers/oauth.controller.ts#L56-L92"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/commit/42128735eba328d157c2e90b98795cb248dc0847"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/releases/tag/2026.08.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/nocodb/nocodb/security/advisories/GHSA-532v-ccph-m3xg"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/nocodb-0.300.0-before-2026.08.0-unauthenticated-oauth-authorization-code-creation"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121825.json b/data/2026/CVE-2026-121825.json index 47a8793fdf..90e3a7bc42 100644 --- a/data/2026/CVE-2026-121825.json +++ b/data/2026/CVE-2026-121825.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://github.com/openam-jp/openam","defaultStatus":"unaffected","modules":["Liberty ID-FF"],"product":"OpenAM (OpenAM Consortium Edition)","vendor":"OpenAM consortium","versions":[{"lessThan":"14.0.6","status":"affected","version":"14.0.0","versionType":"semver"}]}],"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints."}],"id":"CVE-2026-121825","lastModified":"2026-11-10T17:17:23.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:46:17.169668Z","version":"2.0.3"}}]},"published":"2026-11-09T03:16:36.240","references":[{"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8"},{"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","url":"https://openam-jp.github.io/Advisories/CVE-2026-121825/"}],"sourceIdentifier":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/openam-jp/openam","defaultStatus":"unaffected","modules":["Liberty ID-FF"],"product":"OpenAM (OpenAM Consortium Edition)","vendor":"OpenAM consortium","versions":[{"lessThan":"14.0.6","status":"affected","version":"14.0.0","versionType":"semver"}]}],"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14"}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints."}],"id":"CVE-2026-121825","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:46:17.169668Z","version":"2.0.3"}}]},"published":"2026-11-09T03:16:36.240","references":[{"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","url":"https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8"},{"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","url":"https://openam-jp.github.io/Advisories/CVE-2026-121825/"}],"sourceIdentifier":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"37c6977f-aa3f-41e8-829b-3e8ff4df3c14","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121936.json b/data/2026/CVE-2026-121936.json index 3fea13436e..c6891957b8 100644 --- a/data/2026/CVE-2026-121936.json +++ b/data/2026/CVE-2026-121936.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/cosin2077/easyVoice","product":"easyVoice","repo":"https://github.com/cosin2077/easyVoice","vendor":"cosin2077","versions":[{"lessThan":"0.0.23","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports."}],"id":"CVE-2026-121936","lastModified":"2026-11-04T19:17:33.683","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121936","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:56:05.465314Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/blob/be08c5f3fed07f3af749defcf04e590ffcb0c48d/packages/backend/src/utils/ssrf.ts#L28-L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/commit/82fcb5b2f324c84b3f1808b29c6f44df16ccd42e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/issues/87"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/pull/88"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/releases/tag/v0.0.23"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/easyvoice-before-0.0.23-ssrf-via-openaibaseurl-in-tts-api"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/cosin2077/easyVoice/issues/87"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/cosin2077/easyVoice","product":"easyVoice","repo":"https://github.com/cosin2077/easyVoice","vendor":"cosin2077","versions":[{"lessThan":"0.0.23","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports."}],"id":"CVE-2026-121936","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121936","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:56:05.465314Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.703","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/blob/be08c5f3fed07f3af749defcf04e590ffcb0c48d/packages/backend/src/utils/ssrf.ts#L28-L47"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/commit/82fcb5b2f324c84b3f1808b29c6f44df16ccd42e"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/issues/87"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/pull/88"},{"source":"disclosure@vulncheck.com","url":"https://github.com/cosin2077/easyVoice/releases/tag/v0.0.23"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/easyvoice-before-0.0.23-ssrf-via-openaibaseurl-in-tts-api"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/cosin2077/easyVoice/issues/87"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121937.json b/data/2026/CVE-2026-121937.json index 3370f9bc4b..7b62377947 100644 --- a/data/2026/CVE-2026-121937.json +++ b/data/2026/CVE-2026-121937.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blackholll/loonflow","product":"loonflow","repo":"https://github.com/blackholll/loonflow","vendor":"blackholll","versions":[{"lessThan":"r3.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers."}],"id":"CVE-2026-121937","lastModified":"2026-11-04T19:17:33.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121937","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:55:17.049546Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.870","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/blob/r3.2.2/backend/apps/ticket/views.py#L265-L286"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/commit/a6495b0c2ca9e5dede8e49217a0468bcfa946de4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/issues/591"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/loonflow-ticket-flow-history-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/loonflow-before-r3-2.3-idor-via-ticket-flow-history-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121937-loonflow-ticket-flow-history-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/blackholll/loonflow","product":"loonflow","repo":"https://github.com/blackholll/loonflow","vendor":"blackholll","versions":[{"lessThan":"r3.2.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which skips ticket_view_permission_check, to obtain approval comments and processor names, emails and phone numbers."}],"id":"CVE-2026-121937","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121937","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:55:17.049546Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:27.870","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/blob/r3.2.2/backend/apps/ticket/views.py#L265-L286"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/commit/a6495b0c2ca9e5dede8e49217a0468bcfa946de4"},{"source":"disclosure@vulncheck.com","url":"https://github.com/blackholll/loonflow/issues/591"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/loonflow-ticket-flow-history-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/loonflow-before-r3-2.3-idor-via-ticket-flow-history-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121937-loonflow-ticket-flow-history-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121938.json b/data/2026/CVE-2026-121938.json index eb4511ba09..7a8bdfcc1e 100644 --- a/data/2026/CVE-2026-121938.json +++ b/data/2026/CVE-2026-121938.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/moyangzhan/langchain4j-aideepin","product":"langchain4j-aideepin","repo":"https://github.com/moyangzhan/langchain4j-aideepin","vendor":"moyangzhan","versions":[{"lessThan":"3.31.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs."}],"id":"CVE-2026-121938","lastModified":"2026-11-04T19:17:34.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121938","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:50:02.027188Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.30.0/server/adi-common/src/main/java/com/moyz/adi/common/service/CharacterService.java#L105-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/commit/9b2fee6b66836a0efd5599cfcddd05b80b05ca93"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/issues/116"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/pull/117"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/langchain4j-aideepin-character-conversation-cross-user-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/langchain4j-aideepin-before-3.31.0-idor-via-get-character-uuid"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121938-langchain4j-aideepin-character-conversation-cross-user-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/moyangzhan/langchain4j-aideepin","product":"langchain4j-aideepin","repo":"https://github.com/moyangzhan/langchain4j-aideepin","vendor":"moyangzhan","versions":[{"lessThan":"3.31.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs."}],"id":"CVE-2026-121938","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121938","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:50:02.027188Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.040","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/blob/v3.30.0/server/adi-common/src/main/java/com/moyz/adi/common/service/CharacterService.java#L105-L125"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/commit/9b2fee6b66836a0efd5599cfcddd05b80b05ca93"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/issues/116"},{"source":"disclosure@vulncheck.com","url":"https://github.com/moyangzhan/langchain4j-aideepin/pull/117"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/langchain4j-aideepin-character-conversation-cross-user-idor"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/langchain4j-aideepin-before-3.31.0-idor-via-get-character-uuid"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121938-langchain4j-aideepin-character-conversation-cross-user-idor"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121940.json b/data/2026/CVE-2026-121940.json index 4c55156b6d..47ded53a46 100644 --- a/data/2026/CVE-2026-121940.json +++ b/data/2026/CVE-2026-121940.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Stonewuu/ai-fusion-video","product":"ai-fusion-video","repo":"https://github.com/Stonewuu/ai-fusion-video","vendor":"Stonewuu","versions":[{"lessThan":"1.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members."}],"id":"CVE-2026-121940","lastModified":"2026-11-04T19:17:34.313","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121940","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:53:21.275816Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.393","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/project/ProjectController.java#L37-L113"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/commit/4724a1a4173171c3d4d067f38840a6093a8c4d46"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/issues/69"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/ai-fusion-video-idor-bola-project-asset"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/stonewuu-ai-fusion-video-before-1.3.0-idor-via-project-asset-and-script-controllers"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121940-ai-fusion-video-idor-bola-project-asset"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/Stonewuu/ai-fusion-video","product":"ai-fusion-video","repo":"https://github.com/Stonewuu/ai-fusion-video","vendor":"Stonewuu","versions":[{"lessThan":"1.3.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members."}],"id":"CVE-2026-121940","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121940","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:53:21.275816Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.393","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/project/ProjectController.java#L37-L113"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/commit/4724a1a4173171c3d4d067f38840a6093a8c4d46"},{"source":"disclosure@vulncheck.com","url":"https://github.com/Stonewuu/ai-fusion-video/issues/69"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieuPenguinnn/ai-fusion-video-idor-bola-project-asset"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/stonewuu-ai-fusion-video-before-1.3.0-idor-via-project-asset-and-script-controllers"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieuPenguinnn/cve-2026-121940-ai-fusion-video-idor-bola-project-asset"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121941.json b/data/2026/CVE-2026-121941.json index f115c93737..a1b19a0545 100644 --- a/data/2026/CVE-2026-121941.json +++ b/data/2026/CVE-2026-121941.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/munt/munt","product":"libmt32emu","repo":"https://github.com/munt/munt","vendor":"munt","versions":[{"lessThan":"2.8.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application."}],"id":"CVE-2026-121941","lastModified":"2026-11-04T21:18:06.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121941","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:17:29.860940Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.560","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/blob/libmt32emu_2_8_3/mt32emu/src/MidiStreamParser.cpp#L223-L257"},{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/commit/1749f7fed5cdb3a9015acce076a1512b1615dc3b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/issues/149"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@haindpwn/munt-midistreamparser-oversized-sysex-heap-overflow"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/libmt32emu-before-2.8.4-heap-buffer-overflow-via-midistreamparserimpl-parsesysex"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@haindpwn/cve-2026-121941-munt-midistreamparser-oversized-sysex-heap-overflow"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/munt/munt","product":"libmt32emu","repo":"https://github.com/munt/munt","vendor":"munt","versions":[{"lessThan":"2.8.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application."}],"id":"CVE-2026-121941","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.5,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121941","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:17:29.860940Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:28.560","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/blob/libmt32emu_2_8_3/mt32emu/src/MidiStreamParser.cpp#L223-L257"},{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/commit/1749f7fed5cdb3a9015acce076a1512b1615dc3b"},{"source":"disclosure@vulncheck.com","url":"https://github.com/munt/munt/issues/149"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@haindpwn/munt-midistreamparser-oversized-sysex-heap-overflow"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/libmt32emu-before-2.8.4-heap-buffer-overflow-via-midistreamparserimpl-parsesysex"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@haindpwn/cve-2026-121941-munt-midistreamparser-oversized-sysex-heap-overflow"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121945.json b/data/2026/CVE-2026-121945.json index 3813e5482c..5ce01043ed 100644 --- a/data/2026/CVE-2026-121945.json +++ b/data/2026/CVE-2026-121945.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/coopcycle/coopcycle-web","product":"coopcycle-web","repo":"https://github.com/coopcycle/coopcycle-web","vendor":"CoopCycle","versions":[{"lessThan":"6.20.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks."}],"id":"CVE-2026-121945","lastModified":"2026-11-04T19:17:34.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121945","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:44:21.765480Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.313","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Entity/Incident/Incident.php#L43-L71"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/commit/d997393d128afa1febe34e8f295b9511c12d19a0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/issues/5390"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/coopcycle-incident-courier-cross-tenant-bola"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-before-6.20.1-idor-via-incident-resource-and-action-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieund/cve-2026-121945-coopcycle-incident-courier-cross-tenant-bola"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/coopcycle/coopcycle-web","product":"coopcycle-web","repo":"https://github.com/coopcycle/coopcycle-web","vendor":"CoopCycle","versions":[{"lessThan":"6.20.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks."}],"id":"CVE-2026-121945","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121945","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:44:21.765480Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.313","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/blob/v6.19.1/src/Entity/Incident/Incident.php#L43-L71"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/commit/d997393d128afa1febe34e8f295b9511c12d19a0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coopcycle/coopcycle-web/issues/5390"},{"source":"disclosure@vulncheck.com","url":"https://hackmd.io/@hieund/coopcycle-incident-courier-cross-tenant-bola"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coopcycle-coopcycle-web-before-6.20.1-idor-via-incident-resource-and-action-endpoint"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://hackmd.io/@hieund/cve-2026-121945-coopcycle-incident-courier-cross-tenant-bola"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121946.json b/data/2026/CVE-2026-121946.json index e1ccdeabe1..6045551c6d 100644 --- a/data/2026/CVE-2026-121946.json +++ b/data/2026/CVE-2026-121946.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/zbateson/mail-mime-parser","product":"mail-mime-parser","repo":"https://github.com/zbateson/mail-mime-parser","vendor":"zbateson","versions":[{"lessThan":"3.0.9","status":"affected","version":"0.3.0","versionType":"semver"},{"lessThan":"4.0.6","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages."}],"id":"CVE-2026-121946","lastModified":"2026-11-04T19:17:35.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121946","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:48:57.168802Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.477","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php#L270-L273"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:composer/zbateson/mail-mime-parser","product":"mail-mime-parser","repo":"https://github.com/zbateson/mail-mime-parser","vendor":"zbateson","versions":[{"lessThan":"3.0.9","status":"affected","version":"0.3.0","versionType":"semver"},{"lessThan":"4.0.6","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages."}],"id":"CVE-2026-121946","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121946","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:48:57.168802Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.477","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php#L270-L273"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a"},{"source":"disclosure@vulncheck.com","url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-93"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121967.json b/data/2026/CVE-2026-121967.json index 616d89c289..e3514e8660 100644 --- a/data/2026/CVE-2026-121967.json +++ b/data/2026/CVE-2026-121967.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.37.5","status":"affected","version":"2.37.0","versionType":"semver"},{"status":"unaffected","version":"2.37.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.8","status":"affected","version":"2.36.0","versionType":"semver"},{"status":"unaffected","version":"2.36.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.35.10","status":"affected","version":"2.35.0","versionType":"semver"},{"status":"unaffected","version":"2.35.10","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.34.13","status":"affected","version":"2.30.0","versionType":"semver"},{"status":"unaffected","version":"2.34.13","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.29.22","status":"affected","version":"2.28.0","versionType":"semver"},{"status":"unaffected","version":"2.29.22","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.38.1","status":"affected","version":"2.38.0","versionType":"semver"},{"status":"unaffected","version":"2.38.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key."}],"id":"CVE-2026-121967","lastModified":"2026-11-04T19:17:38.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:13:18.040579Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:50.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/pull/30178"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.37.5","status":"affected","version":"2.37.0","versionType":"semver"},{"status":"unaffected","version":"2.37.5","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.36.8","status":"affected","version":"2.36.0","versionType":"semver"},{"status":"unaffected","version":"2.36.8","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.35.10","status":"affected","version":"2.35.0","versionType":"semver"},{"status":"unaffected","version":"2.35.10","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.34.13","status":"affected","version":"2.30.0","versionType":"semver"},{"status":"unaffected","version":"2.34.13","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.29.22","status":"affected","version":"2.28.0","versionType":"semver"},{"status":"unaffected","version":"2.29.22","versionType":"semver"}]},{"defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/coder/coder/v2","product":"coder","vendor":"coder","versions":[{"lessThan":"2.38.1","status":"affected","version":"2.38.0","versionType":"semver"},{"status":"unaffected","version":"2.38.1","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key."}],"id":"CVE-2026-121967","lastModified":"2026-11-12T21:30:23.870","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:13:18.040579Z","version":"2.0.3"}}]},"published":"2026-11-04T16:17:50.360","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/pull/30178"},{"source":"disclosure@vulncheck.com","url":"https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121968.json b/data/2026/CVE-2026-121968.json index ac669f6db0..b0bf66b43e 100644 --- a/data/2026/CVE-2026-121968.json +++ b/data/2026/CVE-2026-121968.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"netrek-client-cow","vendor":"quozl","versions":[{"lessThanOrEqual":"3.3.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service."}],"id":"CVE-2026-121968","lastModified":"2026-11-05T20:17:49.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121968","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:50.942563Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:06.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L942-L943"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-out-of-bounds-read-via-sp-s-message-packets"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"netrek-client-cow","vendor":"quozl","versions":[{"lessThanOrEqual":"3.3.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service."}],"id":"CVE-2026-121968","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121968","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:25:50.942563Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:06.670","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L942-L943"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-out-of-bounds-read-via-sp-s-message-packets"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-129"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121969.json b/data/2026/CVE-2026-121969.json index 3dcfefec27..ac4838c256 100644 --- a/data/2026/CVE-2026-121969.json +++ b/data/2026/CVE-2026-121969.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"netrek-client-cow","vendor":"quozl","versions":[{"lessThanOrEqual":"3.3.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client."}],"id":"CVE-2026-121969","lastModified":"2026-11-05T20:17:49.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121969","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:27:04.770622Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:06.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/issues/11"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"netrek-client-cow","vendor":"quozl","versions":[{"lessThanOrEqual":"3.3.3","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client."}],"id":"CVE-2026-121969","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121969","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:27:04.770622Z","version":"2.0.3"}}]},"published":"2026-11-04T21:18:06.840","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/blob/3.3.3/short.c#L949"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/commit/fb322e74abee3b0b76a9c5a31df6aab5585d3127"},{"source":"disclosure@vulncheck.com","url":"https://github.com/quozl/netrek-client-cow/issues/11"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/netrek-client-cow-through-3.3.3-stack-buffer-overflow-via-handlesmessage"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121970.json b/data/2026/CVE-2026-121970.json index dd96c707ec..2dc6463aaf 100644 --- a/data/2026/CVE-2026-121970.json +++ b/data/2026/CVE-2026-121970.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pay with Vipps and MobilePay for WooCommerce","vendor":"wphostingdev","versions":[{"lessThan":"6.4.1","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription."}],"id":"CVE-2026-121970","lastModified":"2026-11-04T19:17:38.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:46:57.425233Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.670","references":[{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/changelog.txt"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/includes/wc-vipps-recurring.php"},{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/woo-vipps/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Pay with Vipps and MobilePay for WooCommerce","vendor":"wphostingdev","versions":[{"lessThan":"6.4.1","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription."}],"id":"CVE-2026-121970","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121970","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:46:57.425233Z","version":"2.0.3"}}]},"published":"2026-11-04T13:17:29.670","references":[{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/changelog.txt"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/includes/wc-vipps-recurring.php"},{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/woo-vipps/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/pay-with-vipps-and-mobilepay-for-woocommerce-before-webhook-signature-forgery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-121993.json b/data/2026/CVE-2026-121993.json index f2fbd656ab..7060b488d3 100644 --- a/data/2026/CVE-2026-121993.json +++ b/data/2026/CVE-2026-121993.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/getdokan/wepos","product":"wePOS – Point Of Sale (POS) for WooCommerce & Dokan","repo":"https://github.com/getdokan/wepos","vendor":"wedevs","versions":[{"lessThan":"2.0.3","status":"affected","version":"1.2.6","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment."}],"id":"CVE-2026-121993","lastModified":"2026-11-04T19:17:38.857","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121993","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:45:56.958775Z","version":"2.0.3"}}]},"published":"2026-11-04T14:17:39.050","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getdokan/wepos/pull/232"},{"source":"disclosure@vulncheck.com","url":"https://github.com/getdokan/wepos/releases/tag/v2.0.3"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/log/wepos/"},{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/wepos/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wepos-before-missing-authorization-via-payment-process-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/getdokan/wepos","product":"wePOS – Point Of Sale (POS) for WooCommerce & Dokan","repo":"https://github.com/getdokan/wepos","vendor":"wedevs","versions":[{"lessThan":"2.0.3","status":"affected","version":"1.2.6","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment."}],"id":"CVE-2026-121993","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-121993","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:45:56.958775Z","version":"2.0.3"}}]},"published":"2026-11-04T14:17:39.050","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/getdokan/wepos/pull/232"},{"source":"disclosure@vulncheck.com","url":"https://github.com/getdokan/wepos/releases/tag/v2.0.3"},{"source":"disclosure@vulncheck.com","url":"https://plugins.trac.wordpress.org/log/wepos/"},{"source":"disclosure@vulncheck.com","url":"https://wordpress.org/plugins/wepos/#developers"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/wepos-before-missing-authorization-via-payment-process-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122006.json b/data/2026/CVE-2026-122006.json index fdc2b20563..684d2bafa6 100644 --- a/data/2026/CVE-2026-122006.json +++ b/data/2026/CVE-2026-122006.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:gem/activestorage","product":"Active Storage","vendor":"rubyonrails","versions":[{"lessThan":"8.0.5.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"8.1.4.1","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality."}],"id":"CVE-2026-122006","lastModified":"2026-11-09T22:18:33.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:12:06.478651Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.940","references":[{"source":"cve@mitre.org","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"cve@mitre.org","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"cve@mitre.org","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/rubysec/ruby-advisory-db/pull/1300"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"cve@mitre.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:gem/activestorage","product":"Active Storage","vendor":"rubyonrails","versions":[{"lessThan":"8.0.5.2","status":"affected","version":"0","versionType":"custom"},{"lessThan":"8.1.4.1","status":"affected","version":"8.1","versionType":"custom"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality."}],"id":"CVE-2026-122006","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122006","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:12:06.478651Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:42.940","references":[{"source":"cve@mitre.org","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"source":"cve@mitre.org","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"source":"cve@mitre.org","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://github.com/rubysec/ruby-advisory-db/pull/1300"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1188"}],"source":"cve@mitre.org","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122007.json b/data/2026/CVE-2026-122007.json index a8d9718b57..ae88bb0e89 100644 --- a/data/2026/CVE-2026-122007.json +++ b/data/2026/CVE-2026-122007.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/oqtane/oqtane.framework","product":"oqtane.framework","repo":"https://github.com/oqtane/oqtane.framework","vendor":"oqtane","versions":[{"lessThan":"10.3.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges."}],"id":"CVE-2026-122007","lastModified":"2026-11-04T19:17:39.143","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:35:31.181155Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:43.127","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.oqtane.org/blog/!/160/oqtane-10-3-released"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/oqtane/oqtane.framework","product":"oqtane.framework","repo":"https://github.com/oqtane/oqtane.framework","vendor":"oqtane","versions":[{"lessThan":"10.3.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary entityId for Site or Role type settings, since IsAuthorized and FilterPrivate fail to verify the requested site matches the current alias SiteId. Attackers can exploit the /api/setting endpoints to disclose private values such as SMTPPassword, SMTPClientSecret, and ExternalLogin ClientSecret, and to alter another site's OIDC/OAuth2 authentication configuration without requiring host privileges."}],"id":"CVE-2026-122007","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.2,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-04T18:35:31.181155Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:43.127","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.oqtane.org/blog/!/160/oqtane-10-3-released"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/oqtane-framework-before-broken-access-control-via-settingcontroller"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122008.json b/data/2026/CVE-2026-122008.json index 96954b3d61..f50609e0eb 100644 --- a/data/2026/CVE-2026-122008.json +++ b/data/2026/CVE-2026-122008.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/oqtane/oqtane.framework","product":"oqtane.framework","repo":"https://github.com/oqtane/oqtane.framework","vendor":"oqtane","versions":[{"lessThan":"10.3.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports."}],"id":"CVE-2026-122008","lastModified":"2026-11-04T21:18:07.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:19:17.348074Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:43.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.oqtane.org/blog/!/160/oqtane-10-3-released"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/oqtane-framework-before-ssrf-via-file-upload-from-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/oqtane/oqtane.framework","product":"oqtane.framework","repo":"https://github.com/oqtane/oqtane.framework","vendor":"oqtane","versions":[{"lessThan":"10.3.0","status":"affected","version":"1.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports."}],"id":"CVE-2026-122008","lastModified":"2026-11-12T21:36:06.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-04T20:19:17.348074Z","version":"2.0.3"}}]},"published":"2026-11-04T15:17:43.330","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/oqtane/oqtane.framework/releases/tag/v10.3.0"},{"source":"disclosure@vulncheck.com","url":"https://www.oqtane.org/blog/!/160/oqtane-10-3-released"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/oqtane-framework-before-ssrf-via-file-upload-from-url"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122054.json b/data/2026/CVE-2026-122054.json index e4786b495d..9a1857f0d0 100644 --- a/data/2026/CVE-2026-122054.json +++ b/data/2026/CVE-2026-122054.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.31","status":"affected","version":"2.18","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}],"id":"CVE-2026-122054","lastModified":"2026-11-09T22:18:33.413","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122054","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:07:39.196812Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.253","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=25734"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/10"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"glibc","vendor":"The GNU C Library","versions":[{"lessThanOrEqual":"2.31","status":"affected","version":"2.18","versionType":"custom"}]}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}],"id":"CVE-2026-122054","lastModified":"2026-11-12T22:09:39.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-122054","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T21:07:39.196812Z","version":"2.0.3"}}]},"published":"2026-11-04T18:17:43.253","references":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/bugzilla/show_bug.cgi?id=25734"},{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","url":"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"http://www.openwall.com/lists/oss-security/2026/11/04/10"}],"sourceIdentifier":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-122095.json b/data/2026/CVE-2026-122095.json index 25f2ae6f36..1d48d4c876 100644 --- a/data/2026/CVE-2026-122095.json +++ b/data/2026/CVE-2026-122095.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["Management Console (sysmgnt) - menu-icon upload"],"product":"BSS Platform","vendor":"AsiaInfo","versions":[{"lessThan":"9.2.38","status":"affected","version":"9.2.0","versionType":"semver"}]}],"source":"cve@mitre.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via /