diff --git a/data/2026/CVE-2026-129356.json b/data/2026/CVE-2026-129356.json
new file mode 100644
index 0000000000..3a39c924c8
--- /dev/null
+++ b/data/2026/CVE-2026-129356.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:*:*:*"],"modules":["Common Prefix Handler"],"product":"vllm","vendor":"vllm-project","versions":[{"status":"affected","version":"0.30.0"},{"status":"affected","version":"0.31.0"},{"status":"unaffected","version":"0.32.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 0.32.0 is able to resolve this issue. The patch is identified as e687a251bb056fa527846633f7a1b0a6c0f42374. You should upgrade the affected component."}],"id":"CVE-2026-129356","lastModified":"2026-11-15T02:17:21.153","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"HIGH","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":4.6,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:H/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":3.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":1.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-15T02:17:20.967","references":[{"source":"cna@vuldb.com","url":"https://github.com/vllm-project/vllm/"},{"source":"cna@vuldb.com","url":"https://github.com/vllm-project/vllm/commit/e687a251bb056fa527846633f7a1b0a6c0f42374"},{"source":"cna@vuldb.com","url":"https://github.com/vllm-project/vllm/issues/61673"},{"source":"cna@vuldb.com","url":"https://github.com/vllm-project/vllm/pull/61126"},{"source":"cna@vuldb.com","url":"https://github.com/vllm-project/vllm/releases/tag/v0.32.0"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129356"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1043823"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437419"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437419/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"cna@vuldb.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129454.json b/data/2026/CVE-2026-129454.json
new file mode 100644
index 0000000000..9e43759260
--- /dev/null
+++ b/data/2026/CVE-2026-129454.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/izhaorui/Zr.Admin.NET","product":"Zr.Admin.NET","repo":"https://github.com/izhaorui/Zr.Admin.NET","vendor":"izhaorui","versions":[{"lessThanOrEqual":"eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","status":"affected","version":"85cff6ae22389c241d3a4efe178273966650f7ca","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege attackers can enumerate sequential instance IDs to read other users' approval requests, including submitted form contents, applicant details and approval records."}],"id":"CVE-2026-129454","lastModified":"2026-11-15T02:17:21.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-15T02:17:21.243","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Controllers/WfFlowInstanceController.cs#L49-L57"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Workflow/Service/WfFlowInstanceService.cs#L173-L176"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/commit/85cff6ae22389c241d3a4efe178273966650f7ca"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261114/zr-admin-net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-85cff6a-through-eb9228a-idor-via-workflow-instance-endpoint"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129455.json b/data/2026/CVE-2026-129455.json
new file mode 100644
index 0000000000..588d82e2ec
--- /dev/null
+++ b/data/2026/CVE-2026-129455.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/izhaorui/Zr.Admin.NET","product":"Zr.Admin.NET","repo":"https://github.com/izhaorui/Zr.Admin.NET","vendor":"izhaorui","versions":[{"lessThanOrEqual":"eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","status":"affected","version":"e6ceaf47548f1a485f3ba3f4c139905e90fee0a2","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can send PUT /front/article/changePublic with their own UserId in the body to make private articles public, then read them anonymously via GET /front/article/{id}."}],"id":"CVE-2026-129455","lastModified":"2026-11-15T02:17:21.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-15T02:17:21.420","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/Content/FrontArticleController.cs#L122-L148"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Service/Content/ArticleService.cs#L402-L437"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261114/zr-admin-net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-e6ceaf4-through-eb9228a-idor-via-front-article-api"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129464.json b/data/2026/CVE-2026-129464.json
new file mode 100644
index 0000000000..53efb359ee
--- /dev/null
+++ b/data/2026/CVE-2026-129464.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/izhaorui/Zr.Admin.NET","product":"Zr.Admin.NET","repo":"https://github.com/izhaorui/Zr.Admin.NET","vendor":"izhaorui","versions":[{"lessThanOrEqual":"eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","status":"affected","version":"0ee1ab8af5e3861766746d25acba1184111befcb","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or ../ sequences to read appsettings files and use the JwtSettings SecretKey to forge administrator tokens."}],"id":"CVE-2026-129464","lastModified":"2026-11-15T02:17:21.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-15T02:17:21.597","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/Infrastructure/Controllers/BaseController.cs#L110-L119"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/CommonController.cs#L220-L241"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/commit/0ee1ab8af5e3861766746d25acba1184111befcb"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261114/zr-admin-net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-0ee1ab8-through-eb9228a-path-traversal-via-downloadfile"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129465.json b/data/2026/CVE-2026-129465.json
new file mode 100644
index 0000000000..5e31c62e33
--- /dev/null
+++ b/data/2026/CVE-2026-129465.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/izhaorui/Zr.Admin.NET","product":"Zr.Admin.NET","repo":"https://github.com/izhaorui/Zr.Admin.NET","vendor":"izhaorui","versions":[{"lessThanOrEqual":"eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","status":"affected","version":"af07ffc5d18e7876d3780d1ff5ee776b80950399","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set the administrator's phone number to one they control, request an SMS code via /checkMobile, and log in through /PhoneLogin to take over the administrator account."}],"id":"CVE-2026-129465","lastModified":"2026-11-15T02:17:21.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-15T02:17:21.770","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysLoginController.cs#L516-L559"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/SysProfileController.cs#L62-L75"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.ServiceCore/Services/SysUserService.cs#L220-L236"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/commit/af07ffc5d18e7876d3780d1ff5ee776b80950399"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261114/zr-admin-net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-af07ffc-through-eb9228a-idor-via-system-user-profile"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-639"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/data/2026/CVE-2026-129466.json b/data/2026/CVE-2026-129466.json
new file mode 100644
index 0000000000..a640eda6bb
--- /dev/null
+++ b/data/2026/CVE-2026-129466.json
@@ -0,0 +1 @@
+{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/izhaorui/Zr.Admin.NET","product":"Zr.Admin.NET","repo":"https://github.com/izhaorui/Zr.Admin.NET","vendor":"izhaorui","versions":[{"lessThanOrEqual":"eb9228a23014f6000c06cab2f10ae0d44ecbbd3a","status":"affected","version":"1845017b67b3de3d12fad0238f5493235f70a93d","versionType":"git"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain task ids from the unprotected /monitor/jobLog/list endpoint and retrieve job parameters, API URLs, cron expressions, and stored SQL statements."}],"id":"CVE-2026-129466","lastModified":"2026-11-15T02:17:22.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-15T02:17:21.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L145-L157"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksController.cs#L84-L120"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/blob/eb9228a23014f6000c06cab2f10ae0d44ecbbd3a/ZR.Admin.WebApi/Controllers/System/TasksLogController.cs#L31-L46"},{"source":"disclosure@vulncheck.com","url":"https://github.com/izhaorui/Zr.Admin.NET/issues/27"},{"source":"disclosure@vulncheck.com","url":"https://vul.yulun.ac.cn/20261114/zr-admin-net/"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zr-admin-net-commit-1845017-through-eb9228a-missing-authorization-via-system-tasks-get"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
diff --git a/state/sync.json b/state/sync.json
index cae6f88f4a..36ea6862de 100644
--- a/state/sync.json
+++ b/state/sync.json
@@ -1 +1 @@
-{"initial_complete":true,"last_run_counts":{"seen":2647,"skipped":2,"unchanged":2635,"written":10},"last_run_mode":"incremental","last_successful_end":"2026-11-15T02:10:24+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-15T02:15:58.741101+00:00"}
+{"initial_complete":true,"last_run_counts":{"seen":1969,"skipped":2,"unchanged":1961,"written":6},"last_run_mode":"incremental","last_successful_end":"2026-11-15T02:47:04+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-15T02:52:24.027082+00:00"}