VULN/vuln-nvd
1
0 Fork 0
Code Pull Requests Actions Activity

NVD update 2026-11-14T18:48:23Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-14 19:48:28 +01:00
1 parent 870bb1ea64
commit f31988f92e
5 files changed
+5 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/CVE-2026-129262.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:wuxi_wubang_security_software:wubang_five-in-one_safety_production_management_information_system:*:*:*:*:*:*:*:*"],"product":"Wubang Five-in-One Safety Production Management Information System","vendor":"Wuxi Wubang Security Software","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-129262","lastModified":"2026-11-14T17:16:52.990","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-14T17:16:52.833","references":[{"source":"cna@vuldb.com","url":"https://github.com/Rookie506/CVE/issues/3"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129262"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1043317"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437306"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437306/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}],"source":"cna@vuldb.com","type":"Primary"}]}
data/2026/CVE-2026-129264.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sox_ng:sox_ng:*:*:*:*:*:*:*:*"],"modules":["VOC Decoder"],"product":"sox_ng","vendor":"n/a","versions":[{"status":"affected","version":"14.8.0"},{"status":"affected","version":"14.8.1"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 0b40408b. A patch should be applied to remediate this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}],"id":"CVE-2026-129264","lastModified":"2026-11-14T17:16:53.200","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":6.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":8.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-14T17:16:53.040","references":[{"source":"cna@vuldb.com","url":"https://codeberg.org/sox_ng/sox_ng/commit/0b40408b"},{"source":"cna@vuldb.com","url":"https://codeberg.org/sox_ng/sox_ng/issues/873"},{"source":"cna@vuldb.com","url":"https://codeberg.org/suyuanwang/Test_sox/"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129264"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1043408"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437307"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437307/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}],"source":"cna@vuldb.com","type":"Primary"}]}
data/2026/CVE-2026-129267.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:sergix44:xbackbone:*:*:*:*:*:*:*:*"],"product":"XBackBone","vendor":"sergix44","versions":[{"status":"affected","version":"3.8.0"},{"status":"affected","version":"3.8.1"},{"status":"affected","version":"3.8.2"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance."}],"id":"CVE-2026-129267","lastModified":"2026-11-14T18:17:21.050","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-14T18:17:20.077","references":[{"source":"cna@vuldb.com","url":"https://github.com/sergix44/xbackbone/"},{"source":"cna@vuldb.com","url":"https://github.com/sergix44/xbackbone/pull/673"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-129267"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1043413"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437311"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/437311/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}],"source":"cna@vuldb.com","type":"Primary"}]}
data/2026/CVE-2026-129447.json
+1
View File
@@ -0,0 +1 @@
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:maven/io.kroki/kroki-server","product":"kroki","vendor":"yuzutech","versions":[{"lessThan":"0.36.0","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.36.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup color settings. Attackers can send a crafted SVG link that, when opened and the table header clicked, executes attacker JavaScript in the Kroki origin."}],"id":"CVE-2026-129447","lastModified":"2026-11-14T18:17:21.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-14T18:17:21.100","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/yuzutech/kroki/blob/v0.35.0/dbml/index.js#L13"},{"source":"disclosure@vulncheck.com","url":"https://github.com/yuzutech/kroki/commit/b57e1bdc39df9521b249db0dbd56c5e0a8b7e33d"},{"source":"disclosure@vulncheck.com","url":"https://github.com/yuzutech/kroki/releases/tag/v0.36.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/yuzutech/kroki/security/advisories/GHSA-fr36-wcx2-7gfq"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/kroki-before-0.36.0-reflected-xss-via-dbml-table-urls"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Primary"}]}
state/sync.json
+1 -1
View File
@@ -1 +1 @@
{"initial_complete":true,"last_run_counts":{"seen":3740,"skipped":1,"unchanged":3726,"written":13},"last_run_mode":"incremental","last_successful_end":"2026-11-14T16:42:27+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-14T16:47:52.514676+00:00"}
{"initial_complete":true,"last_run_counts":{"seen":3649,"skipped":1,"unchanged":3644,"written":4},"last_run_mode":"incremental","last_successful_end":"2026-11-14T18:42:28+00:00","schema_version":1,"since_year":2017,"source":"NVD CVE API 2.0","updated_at":"2026-11-14T18:48:12.000710+00:00"}